From 11f3cb0c8b7b0a830c470ce2051d38c3a2f2327e Mon Sep 17 00:00:00 2001 From: PierreCsn Date: Wed, 28 Oct 2026 16:13:38 +0100 Subject: [PATCH] fix(package): commit pinned HardeningKitty assets --- .gitignore | 2 - README.md | 23 +- WAPT/control | 2 +- package-manifest.json | 154 + setup.py | 2 +- vendor/HardeningKitty.psd1 | 119 + vendor/HardeningKitty.psm1 | 3779 +++++++++++++++++ vendor/LICENSE | 21 + .../lists/finding_list_0x6d69636b_machine.csv | 419 ++ vendor/lists/finding_list_0x6d69636b_user.csv | 57 + vendor/lists/finding_list_4d5a_machine.csv | 4 + ...ist_bsi_sisyphus_windows_10_hd_machine.csv | 129 + ...g_list_bsi_sisyphus_windows_10_hd_user.csv | 5 + ...ist_bsi_sisyphus_windows_10_nd_machine.csv | 325 ++ ...g_list_bsi_sisyphus_windows_10_nd_user.csv | 12 + ...ist_bsi_sisyphus_windows_10_ne_machine.csv | 293 ++ ...g_list_bsi_sisyphus_windows_10_ne_user.csv | 12 + ...oft_windows_10_enterprise_1809_machine.csv | 584 +++ ...rosoft_windows_10_enterprise_1809_user.csv | 16 + ...oft_windows_10_enterprise_1903_machine.csv | 586 +++ ...rosoft_windows_10_enterprise_1903_user.csv | 16 + ...oft_windows_10_enterprise_1909_machine.csv | 586 +++ ...rosoft_windows_10_enterprise_1909_user.csv | 16 + ...oft_windows_10_enterprise_2004_machine.csv | 583 +++ ...rosoft_windows_10_enterprise_2004_user.csv | 15 + ...oft_windows_10_enterprise_20h2_machine.csv | 588 +++ ...rosoft_windows_10_enterprise_20h2_user.csv | 15 + ...oft_windows_10_enterprise_21h1_machine.csv | 567 +++ ...rosoft_windows_10_enterprise_21h1_user.csv | 15 + ...oft_windows_10_enterprise_21h2_machine.csv | 586 +++ ...rosoft_windows_10_enterprise_21h2_user.csv | 16 + ...ndows_10_enterprise_22h2_2.0.0_machine.csv | 607 +++ ..._windows_10_enterprise_22h2_2.0.0_user.csv | 16 + ...ndows_10_enterprise_22h2_3.0.0_machine.csv | 613 +++ ..._windows_10_enterprise_22h2_3.0.0_user.csv | 13 + ...oft_windows_11_enterprise_21h2_machine.csv | 586 +++ ...rosoft_windows_11_enterprise_21h2_user.csv | 16 + ...oft_windows_11_enterprise_22h2_machine.csv | 614 +++ ...rosoft_windows_11_enterprise_22h2_user.csv | 16 + ...oft_windows_11_enterprise_23h2_machine.csv | 622 +++ ...rosoft_windows_11_enterprise_23h2_user.csv | 14 + ...oft_windows_11_enterprise_24h2_machine.csv | 651 +++ ...rosoft_windows_11_enterprise_24h2_user.csv | 14 + ...oft_windows_11_enterprise_25h2_machine.csv | 594 +++ ...rosoft_windows_11_enterprise_25h2_user.csv | 12 + ...t_windows_server_2012_r2_2.4.0_machine.csv | 358 ++ ...soft_windows_server_2012_r2_2.4.0_user.csv | 12 + ...t_windows_server_2012_r2_2.6.0_machine.csv | 372 ++ ...soft_windows_server_2012_r2_2.6.0_user.csv | 11 + ...t_windows_server_2012_r2_3.0.0_machine.csv | 399 ++ ...soft_windows_server_2012_r2_3.0.0_user.csv | 11 + ...windows_server_2016_1607_1.2.0_machine.csv | 387 ++ ...ft_windows_server_2016_1607_1.2.0_user.csv | 16 + ...windows_server_2016_1607_1.3.0_machine.csv | 391 ++ ...ft_windows_server_2016_1607_1.3.0_user.csv | 16 + ...windows_server_2016_1607_2.0.0_machine.csv | 437 ++ ...ft_windows_server_2016_1607_2.0.0_user.csv | 16 + ...windows_server_2016_1607_3.0.0_machine.csv | 440 ++ ...ft_windows_server_2016_1607_3.0.0_user.csv | 13 + ...windows_server_2019_1809_1.1.0_machine.csv | 412 ++ ...ft_windows_server_2019_1809_1.1.0_user.csv | 16 + ...windows_server_2019_1809_1.2.1_machine.csv | 419 ++ ...ft_windows_server_2019_1809_1.2.1_user.csv | 16 + ...windows_server_2019_1809_2.0.0_machine.csv | 450 ++ ...ft_windows_server_2019_1809_2.0.0_user.csv | 16 + ...windows_server_2019_1809_3.0.0_machine.csv | 455 ++ ...ft_windows_server_2019_1809_3.0.0_user.csv | 13 + ...windows_server_2022_21h2_1.0.0_machine.csv | 439 ++ ...ft_windows_server_2022_21h2_1.0.0_user.csv | 16 + ...windows_server_2022_22h2_2.0.0_machine.csv | 460 ++ ...ft_windows_server_2022_22h2_2.0.0_user.csv | 16 + ...windows_server_2022_22h2_3.0.0_machine.csv | 466 ++ ...ft_windows_server_2022_22h2_3.0.0_user.csv | 13 + ...windows_server_2022_22h2_4.0.0_machine.csv | 482 +++ ...ft_windows_server_2022_22h2_4.0.0_user.csv | 13 + ...windows_server_2025_24h2_1.0.0_machine.csv | 500 +++ ...ft_windows_server_2025_24h2_1.0.0_user.csv | 13 + ...microsoft_windows_10_stig_v2r1_machine.csv | 394 ++ ...od_microsoft_windows_10_stig_v2r1_user.csv | 5 + ...ndows_server_2019_dc_stig_v2r1_machine.csv | 361 ++ ..._windows_server_2019_dc_stig_v2r1_user.csv | 3 + ...s_server_2019_member_stig_v2r1_machine.csv | 357 ++ ...dows_server_2019_member_stig_v2r1_user.csv | 3 + ...d_windows_defender_antivirus_stig_v2r1.csv | 32 + ...ng_list_dod_windows_firewall_stig_v1r7.csv | 19 + vendor/lists/finding_list_intune.csv | 1898 +++++++++ .../finding_list_microsoft_windows_tls.csv | 62 + ...ding_list_microsoft_windows_tls_future.csv | 66 + ...sft_security_baseline_edge_107_machine.csv | 24 + ...sft_security_baseline_edge_112_machine.csv | 21 + ...sft_security_baseline_edge_114_machine.csv | 19 + ...sft_security_baseline_edge_117_machine.csv | 20 + ...sft_security_baseline_edge_128_machine.csv | 20 + ...sft_security_baseline_edge_139_machine.csv | 20 + ...sft_security_baseline_edge_151_machine.csv | 25 + ...msft_security_baseline_edge_87_machine.csv | 14 + ...msft_security_baseline_edge_88_machine.csv | 15 + ...msft_security_baseline_edge_92_machine.csv | 17 + ...msft_security_baseline_edge_93_machine.csv | 17 + ...msft_security_baseline_edge_95_machine.csv | 19 + ...msft_security_baseline_edge_96_machine.csv | 21 + ...msft_security_baseline_edge_97_machine.csv | 22 + ...msft_security_baseline_edge_98_machine.csv | 23 + ...eline_microsoft_365_apps_v2104_machine.csv | 195 + ...baseline_microsoft_365_apps_v2104_user.csv | 152 + ...eline_microsoft_365_apps_v2112_machine.csv | 195 + ...baseline_microsoft_365_apps_v2112_user.csv | 153 + ...eline_microsoft_365_apps_v2206_machine.csv | 195 + ...baseline_microsoft_365_apps_v2206_user.csv | 152 + ...eline_microsoft_365_apps_v2306_machine.csv | 195 + ...baseline_microsoft_365_apps_v2306_user.csv | 156 + ...eline_microsoft_365_apps_v2412_machine.csv | 195 + ...baseline_microsoft_365_apps_v2412_user.csv | 170 + ...eline_microsoft_365_apps_v2512_machine.csv | 195 + ...baseline_microsoft_365_apps_v2512_user.csv | 176 + ...rity_baseline_office_365_v1908_machine.csv | 186 + ...ecurity_baseline_office_365_v1908_user.csv | 135 + ...urity_baseline_windows_10_2004_machine.csv | 367 ++ ..._baseline_windows_10_20h2_21h1_machine.csv | 371 ++ ...urity_baseline_windows_10_21h2_machine.csv | 381 ++ ...urity_baseline_windows_10_22h2_machine.csv | 389 ++ ...security_baseline_windows_10_22h2_user.csv | 6 + ...urity_baseline_windows_11_21h2_machine.csv | 379 ++ ...urity_baseline_windows_11_22h2_machine.csv | 397 ++ ...security_baseline_windows_11_22h2_user.csv | 6 + ...urity_baseline_windows_11_23h2_machine.csv | 408 ++ ...security_baseline_windows_11_23h2_user.csv | 6 + ...urity_baseline_windows_11_24h2_machine.csv | 438 ++ ...security_baseline_windows_11_24h2_user.csv | 6 + ...urity_baseline_windows_11_25h2_machine.csv | 439 ++ ...security_baseline_windows_11_25h2_user.csv | 6 + ...urity_baseline_windows_11_26h2_machine.csv | 439 ++ ...security_baseline_windows_11_26h2_user.csv | 6 + ...aseline_windows_server_2004_dc_machine.csv | 321 ++ ...ine_windows_server_2004_member_machine.csv | 322 ++ ...ne_windows_server_2022_21h2_dc_machine.csv | 329 ++ ...indows_server_2022_21h2_member_machine.csv | 329 ++ ...ne_windows_server_2025_24h2_dc_machine.csv | 355 ++ ...indows_server_2025_24h2_member_machine.csv | 350 ++ ...ne_windows_server_2025_2506_dc_machine.csv | 355 ++ ...indows_server_2025_2506_member_machine.csv | 349 ++ ...ne_windows_server_2025_2602_dc_machine.csv | 363 ++ ...indows_server_2025_2602_member_machine.csv | 355 ++ ...aseline_windows_server_20h2_dc_machine.csv | 326 ++ ...ine_windows_server_20h2_member_machine.csv | 326 ++ vendor/lists/finding_list_translation.csv | 1901 +++++++++ .../lists/hardeningkitty_lists_manifest.psd1 | 144 + .../hardeningkitty_lists_manifest.psd1.p7s | Bin 0 -> 1974 bytes vendor/vendor-manifest.json | 151 + 149 files changed, 37282 insertions(+), 14 deletions(-) create mode 100644 package-manifest.json create mode 100644 vendor/HardeningKitty.psd1 create mode 100644 vendor/HardeningKitty.psm1 create mode 100644 vendor/LICENSE create mode 100644 vendor/lists/finding_list_0x6d69636b_machine.csv create mode 100644 vendor/lists/finding_list_0x6d69636b_user.csv create mode 100644 vendor/lists/finding_list_4d5a_machine.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv create mode 100644 vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv create mode 100644 vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv create mode 100644 vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv create mode 100644 vendor/lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv create mode 100644 vendor/lists/finding_list_dod_windows_firewall_stig_v1r7.csv create mode 100644 vendor/lists/finding_list_intune.csv create mode 100644 vendor/lists/finding_list_microsoft_windows_tls.csv create mode 100644 vendor/lists/finding_list_microsoft_windows_tls_future.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_107_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_112_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_114_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_117_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_128_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_139_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_151_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_87_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_88_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_92_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_93_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_95_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_96_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_97_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_edge_98_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_office_365_v1908_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv create mode 100644 vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv create mode 100644 vendor/lists/finding_list_translation.csv create mode 100644 vendor/lists/hardeningkitty_lists_manifest.psd1 create mode 100644 vendor/lists/hardeningkitty_lists_manifest.psd1.p7s create mode 100644 vendor/vendor-manifest.json diff --git a/.gitignore b/.gitignore index 82791f7..11f4010 100644 --- a/.gitignore +++ b/.gitignore @@ -40,8 +40,6 @@ code_template.cmd package_template.py # Specific to this package (use ! as prefix to allow commit): -/vendor/ -/package-manifest.json !README.md !setup.py !WAPT/control diff --git a/README.md b/README.md index 04f94db..000e37b 100644 --- a/README.md +++ b/README.md @@ -74,19 +74,22 @@ Le proxy système configuré pour Python/urllib est utilisé; la validation TLS par défaut n’est pas désactivée. Une erreur réseau ou d’intégrité arrête la préparation et garde le `vendor/` précédent. -Le répertoire `vendor/` et `package-manifest.json` sont générés et ignorés par -Git, mais restent présents dans les sources pour le builder WAPT. La règle -`.gitignore` est une règle Git; elle ne sert pas de filtre de contenu WAPT. +Le répertoire `vendor/` et `package-manifest.json` sont versionnés avec le +paquet. Ainsi, un clone propre contient directement les composants épinglés et +peut être construit sans téléchargement préalable. **Update Package** permet de +reproduire leur préparation ou de régénérer les manifestes après une évolution +contrôlée de la révision upstream. La règle `.gitignore` est une règle Git; elle +ne sert pas de filtre de contenu WAPT. WAPT applique ses propres exclusions de construction (notamment `.git`, `.gitignore`, `setup.pyc` et `__pycache__` dans les versions documentées). -N’ajoutez pas `vendor/` aux exclusions de construction. +Ne configurez pas `vendor/` comme exclusion de construction. ## Contrôler, construire, signer et publier Avant toute construction, exécuter le contrôle bloquant des sources : ```powershell -python tools\package_verify.py --source C:\waptdev\comi-audit-secu +waptpython tools\package_verify.py --source C:\waptdev\comi-audit-secu ``` Il refuse les assets absents, une révision upstream différente, un manifeste @@ -102,7 +105,7 @@ utiliser **Build and upload** avant la vérification du fichier construit. Inspecter le `.wapt` réellement généré : ```powershell -python tools\package_verify.py --wapt C:\waptdev\comi-audit-secu\comi-audit-hardeningkitty_0.9.6-0_all.wapt +waptpython tools\package_verify.py --wapt C:\waptdev\comi-audit-secu\comi-audit-hardeningkitty_0.9.8-0_all.wapt ``` Cette vérification ouvre l’archive ZIP `.wapt` et contrôle les scripts, @@ -248,12 +251,12 @@ synthétiques et ne modifient pas la configuration Windows. ## Tests synthétiques -Depuis la racine du dépôt, avec Python 3.8 ou ultérieur : +Depuis la racine du dépôt, avec le `waptpython` de l’environnement WAPT : ```powershell -python -m unittest discover -s tests -v -python -m py_compile setup.py update_package.py tools\vendor_assets.py tools\package_verify.py -python tools\package_verify.py --source C:\waptdev\comi-audit-secu +waptpython tests\test_package.py -v +waptpython -m py_compile setup.py update_package.py tools\vendor_assets.py tools\package_verify.py +waptpython tools\package_verify.py --source C:\waptdev\comi-audit-secu ``` Les tests utilisent des listes, rapports et archives synthétiques. Ils couvrent diff --git a/WAPT/control b/WAPT/control index e6d1f49..bda3a97 100644 --- a/WAPT/control +++ b/WAPT/control @@ -1,5 +1,5 @@ package : comi-audit-hardeningkitty -version : 0.9.7-0 +version : 0.9.8-0 architecture : all section : base priority : optional diff --git a/package-manifest.json b/package-manifest.json new file mode 100644 index 0000000..af4ee01 --- /dev/null +++ b/package-manifest.json @@ -0,0 +1,154 @@ +{ + "files": { + "WAPT/control": "ed77db7becfcaf15b7c95b5f169294b1afe320fdcef657f59cb5df2f6b133d14", + "audit_config.json": "9fc18f556fd491e8e00e3a8b1efd864ad8036682e293a02c1f81f3411304a69b", + "runner.ps1": "5e9787f5cc19d0fc4c0ede01a63188ed71de6ef49df596fbce7b2603093231cd", + "setup.py": "e187cbfdd61d96e68b940f124924d2f09ad3d18eb3987116ab55937dea18dc06", + "vendor/HardeningKitty.psd1": "94378764787cd0c7125c5c3ce928803b46ee7d7d3fe21c2b27ddeb23c11377a7", + "vendor/HardeningKitty.psm1": "b799ec1b17de5ce63f7a8ea34af3beba1d24fcaddf7e3774f797096f5c43e2a0", + "vendor/LICENSE": "a879ba6ccdcd2ea55da97b999edd2c401c8589ca946f238236bf93aa40e74d56", + "vendor/lists/finding_list_0x6d69636b_machine.csv": "cc6cf409c7cb0f7dc0caeb82b8323dcc13ddb4dcb88e35e9e2cc4f52874816f4", + "vendor/lists/finding_list_0x6d69636b_user.csv": "c8cf8a5a7b46e4f94d7b57601732a2359651c878e93ad95b3cf8684d0887a2d5", + "vendor/lists/finding_list_4d5a_machine.csv": "d20d7dfbca7f7100fe5cb639a125aeafe163503e7b5856da0308175f1dd15663", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv": "e1e554df8f04513ca288b526fbbad557ea58976197d31f13658e7ebe9bcbf146", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv": "063f7684d3bad43c6221f7193fca1efbd59a92e5a30b08818361f9d03a41ece6", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv": "3117404f5081a907671b5b6a0f5f06cd5e161c131355f3df7220736051b0da5d", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv": "fab458bf91a38cbe5f57212c370c4154874884492389d2e92c8d238651cd9488", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv": "705eff0788457402919ba967095259b922559c6d1ff17f94c866c45428cc9526", + "vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv": "fab458bf91a38cbe5f57212c370c4154874884492389d2e92c8d238651cd9488", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv": "bb5a8b9f0bad5d81e926071a93ce965beda1bb1c4cb7727c7823744da3071a8a", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv": "4557143f380b475bcb3e5118b8f49c039c12ba2c144f7b48cf6202a861eedc63", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv": "4557143f380b475bcb3e5118b8f49c039c12ba2c144f7b48cf6202a861eedc63", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv": "94e42738f1083d618c9d762bd08c44465a03b68d2e5893d038abeaed2d2b821f", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv": "b2c67d9ee3b08db0825a01844035825a6b16529395bb12e8b8ab4b65a4395fb8", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv": "ddabd3fafbe87af595613e051381fc3071f1488615f416deeaddb7c12e416ed2", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv": "4c77315f79e51214306c70591d02b742515b43484820fe14c61ddf7942b98a2b", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv": "d2fca2cc80c0139d10177b0568d8d9bccafc3ef4fa2d978d5809111b3b47cc0d", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv": "4c77315f79e51214306c70591d02b742515b43484820fe14c61ddf7942b98a2b", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv": "c4808aca88037aac3076863ca24099cd52e41c1a3f672947f33e3caf10f083b0", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv": "5fc9546f9a2cd7894aee0d3c80f483ced5e032cc8800082a1d9f15b793bb02c1", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv": "d29c3fd8c788a5a59eccf8ed2e15e8e3756431f70aa787b352da80fe124b0d98", + "vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv": "c4808aca88037aac3076863ca24099cd52e41c1a3f672947f33e3caf10f083b0", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv": "9b94df97ae465a6849b0a25f1e1da857422cf7a20584e296f2cef761c1ef66ca", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv": "af2df99e7a4b65f921b11b71623fba3e2b9f2e8eb21e0f34d24040e958734047", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv": "ed249bca62f1a6a71addfe4b2edf9a23e748e0c083f4ed7e99f35eb6562c6a81", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv": "7263da359d9aef3ffa6b7398cdf0ec87233bedd29d867a0a50dcc1e21df110d8", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv": "5b9e83822a3aa9526b2bfd2bf56d046accc743bf5a45a89332ebea9f93db1003", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv": "02779ea283ef5ddf18cfeb14a05fbb244604e7c042e96b1839dad6b92411a563", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv": "ab6757a924e54116ee1b22c11f1a0fdb5b0b053acc16096551198ce837a0f181", + "vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv": "3c07acb7b8d32444c02a36b1af31a13e8757b7bc9522cfeb815e7a1b41d51520", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv": "2778978b81286378f11834f6ab4384bdfca4023eb89767bfaea21427013b8b59", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv": "1e7a9302ac4361b1ec54ebb66aaf121257d39a6d44b6905ccb4cea5de93bd8fb", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv": "1d23a4bc44936fe3b94faa50ffc5245dce9726b502cb6331497ffcd0998704cb", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv": "420893d86c78c76f07fc346c3224475ae84b873450274e75692e91e936e4a9b6", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv": "8d891f2a16a930c604f4c1d606cded73a233f27b2ed518cb1bc4f553ecf241f8", + "vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv": "10221953c22731fbb5cc96c11cce27e36c96c07c6e55d899d7506dadd0e2f17c", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv": "ce8aa8166ed28ece859a5fe8567c649831322057ab6b1de52aab7b54b15871fb", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv": "7b9a195d4ff36bc7fbdb9bdf261180787e10812fd9516e0f11487e4c4431880b", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv": "612a035a6a6e6fd612f2c96d623318b458b446ea608a983dd7b8bee0934a1bd0", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv": "e23d2e810fc9fbe09886f56e96e8789fd239c7400f681ca13ce829c691a28bc9", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv": "a6c4f1e520c40cb3538b11b4c7a2a9524b3c704d989ffe899a25a8d35521a0c8", + "vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv": "d45a797dfdd6e57b2d4d89f3ebf7968c3394b015108ade945e1b38714ced9c04", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv": "5a118146523c2d0b8c444af901554f179e46954865c4c5b115f4b16d2996cb1f", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv": "612a035a6a6e6fd612f2c96d623318b458b446ea608a983dd7b8bee0934a1bd0", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv": "27004ca663cb422c915610f833c23b79d8f8f4ae1ef33f960c53804d125fd2bf", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv": "bf8e4f821dcef989af9a0189ed9c91e6903b3a80f6f4d0340a8d84e05e36013f", + "vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv": "8c00cac3a709782ee1ced106df9d896a6af3df1adc27745e39d6668a648594f4", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv": "1e1687757aa2339be955f0d12ca8f2c2514ede560ebf143d40ff97b3836d8cd4", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv": "bd1c6f58970885272175afe678c1dc95a9391e6ddf6b408a106199410143029e", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv": "99bc6878f443f1b81a64171068ef3534afe32d636a7c4beab9a6726ead826681", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv": "45dc9010fd9bad2b28e2645c07476d838758d2554d5618be8fd906a588ea844c", + "vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv": "220fbfcfbbcd1ab1910dc689a1a4300dc1c4c2d3ed442b9f8f54cbe6b39e012d", + "vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv": "0c272b427b01a5ecbeb95cbe764e3ad20d1dfcb3e299ce2dd9d72468bc7c368b", + "vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv": "0a2c8354f8c4578f0925a598b1bc855a29fb54458b2465f7e174ab064df9402b", + "vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv": "59a106a408cc7db4a46db87f119ec001b28e27816d5c93cce40af68892eac122", + "vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv": "c8433c698d6f6e08c67d5a36657f23d21369595084daff15a4bb2bc9f75cca07", + "vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv": "6258ccfdebdf18d68a300683cf8b68a57a1c6c98fac5e796e2f7200f1ac020cf", + "vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv": "aa3b8f180bfeedcc690f427fd0756292019f9d991d4f6b06e09371c718a0af07", + "vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv": "6b2dd93bac5391ec14ab1bac2bbd82f01bc2af5db8f3139359469c4591d852a3", + "vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv": "aa3b8f180bfeedcc690f427fd0756292019f9d991d4f6b06e09371c718a0af07", + "vendor/lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv": "00fdfbefc9ac9d00a984d06e2b4c28ddb600852441d82f6f3c875f3c39e5d1b7", + "vendor/lists/finding_list_dod_windows_firewall_stig_v1r7.csv": "82438b3773d7de069cc1e8bf2831df2e678f5d1bde96b31145acb420f213a9da", + "vendor/lists/finding_list_intune.csv": "301cde82e178abdabc4a4f070b8513964a5abb06deac2d719373a6ec41d2707d", + "vendor/lists/finding_list_microsoft_windows_tls.csv": "e2a4fc5ea430764131fc1f2f7bef370bc77c140fc9540e87a630814b55a76d15", + "vendor/lists/finding_list_microsoft_windows_tls_future.csv": "f777f353ae37d1be4de6529b2eb53f45e89ce7283eda2bd020ced4cc65e6c68e", + "vendor/lists/finding_list_msft_security_baseline_edge_107_machine.csv": "2ffba25ae476fd3890038e05e48ad85242442ee826af658071157266bae204bb", + "vendor/lists/finding_list_msft_security_baseline_edge_112_machine.csv": "933fc26792625c7ad345c54fc42607a008cc9b199b7dd5f915a42295ab399251", + "vendor/lists/finding_list_msft_security_baseline_edge_114_machine.csv": "956f68d455dd40eb9aae625df61d6512471e4c99d22a7e39b37708c2c3bb0c87", + "vendor/lists/finding_list_msft_security_baseline_edge_117_machine.csv": "1dc3be1f589082b1e212b08a05f20de2897f8bfd92914bd1a6ca7d5b53447bac", + "vendor/lists/finding_list_msft_security_baseline_edge_128_machine.csv": "a5580c2c1f970c46ff6ca92ec64e81fa49cd301f98c12c2b3053132de06f0b2e", + "vendor/lists/finding_list_msft_security_baseline_edge_139_machine.csv": "4f6354db6f1fe005359ea5e6ea3f6d871664caa538f8f9bb5da9403bc9db3e2a", + "vendor/lists/finding_list_msft_security_baseline_edge_151_machine.csv": "a4c624dfcb1a8c3702ae00e84bc51496b661a51178577de1f1b6f02cdf10a782", + "vendor/lists/finding_list_msft_security_baseline_edge_87_machine.csv": "ad47b85960a61eed3ea25496fe473fae2bd241bcf25a7da0ea6caababa2c2279", + "vendor/lists/finding_list_msft_security_baseline_edge_88_machine.csv": "9b2df280eea330efe6ab6c6c9ccf60a75f47d489a4e1fafdefaa5215de7cbf4b", + "vendor/lists/finding_list_msft_security_baseline_edge_92_machine.csv": "462e950f688bcc23ad46c0fb39ca138b616a7cf4a3f024213c4f86ece39d235f", + "vendor/lists/finding_list_msft_security_baseline_edge_93_machine.csv": "8bb5b5c0812724a870abb7e51d0fe27956781348dab480b4bc4521ea474c2b6b", + "vendor/lists/finding_list_msft_security_baseline_edge_95_machine.csv": "7d9e83a13e6d348a9f02ae985d3299462ec5a83c10b7d0fcc8f13fdbbbfc43ff", + "vendor/lists/finding_list_msft_security_baseline_edge_96_machine.csv": "9ec876d2841daf216dacac4001ddfb820efbf69a69835b4d197531ed67ff601f", + "vendor/lists/finding_list_msft_security_baseline_edge_97_machine.csv": "b2a0a3a5175e8d09586d1bbcfda986e43cd4fe999d8af44b8b5e1513ce393cef", + "vendor/lists/finding_list_msft_security_baseline_edge_98_machine.csv": "95088ae545a08536a9165d463a9248c4af2fffb68ca8b0006d97f039ba5da782", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv": "bc1e668906f6655c01227ec439e85af7f5327352e6a4eafe5647374d5f35aafe", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv": "6e6d998a0a9e790a0c645c6ac43eb1516bf9ffb4e7ec06d884d14d3014b475eb", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv": "8ad1c68511b809fb71d5d23de62a90fe81254f4d72f261a16112083cf98d46eb", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv": "c991fcfc1bd3cece4e7a2b89eec450bffcf75db1b199e4faf07ac0fd64e80d47", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv": "b297aaf0672d66fe4aeb4ac2176b53b1ca5a0108a1af4110f6035592facc445c", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv": "e6501a02f9c2806501bf28bfbf3ae3d30ab1952c06fd8c3873f0a7ddbfa81be2", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv": "0ff36559e0d72ce2587000ee9606a83476539255c8143de8fc9d78dafa2cbe3f", + "vendor/lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv": "0dabc6a74d28bed4f82385f26f89360cb19012cd9efe88837b396b9fadc287f0", + "vendor/lists/finding_list_msft_security_baseline_office_365_v1908_user.csv": "cfbf638cc774f32e0161ecccfa2114c4834089bced1e73aa6ea85c54372839ab", + "vendor/lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv": "c7d05007325a860db6324b57ea259fc35b03097147993f7a522c525865ea9515", + "vendor/lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv": "93e73671e818b6fc8aeb9be9f277f566d4dea7cae435fa6008a36984b3ed9bab", + "vendor/lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv": "d934d6c2ebe13908c559145fb153b8dbf153b77465431cda864bdfb232df9899", + "vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv": "4532166ee8ac11d67da8924aa5aa7e329d869e0171c923cd4d1f075095eeea77", + "vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv": "cfa2d032064126e82e8ae6f072ffe1c29c88fc333b428d61e64a0587e6770235", + "vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv": "88aea6a8167a2a007b362922aae4a6f97497002a8d74556a8661e415b6b85218", + "vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv": "0ff1dba22f3952b3d1671b714e96811d3743f1b92ee8bb6055f2adf33f11f70b", + "vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv": "e9f11394bd87bc69c28e4361fc4ade3155a9f4164b5afe6b58de774a0d3eb218", + "vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv": "87c30f1463db134e5e9e4c7f00b3082f943b7cb8eb7a40a1514bfd97cb4441df", + "vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv": "e38b06ca46c73df32812f4cf08a25b4f729db7bb3e3b768cedd9a4c0faf12850", + "vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv": "2c6e4892feb4c357bfe74568f8cba8f671891daf1a972fac6f360894c0f0e326", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv": "1043108d8c3d1103794d4b9448d53c3c65532dabea850b5c978641a7294ed0ae", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv": "3c1f8db3897abfc4eac975a659f291dfdb691c0a335fe20f33c51ffb5df10929", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv": "40a8f4992877fbe045425ceb387ac69bbfa38472286b3b1194cbf93b1fcbb99e", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv": "cf0c0d259a4f961e4b8eb17906211aae46da1669652ac6f630f22fd3b3cba8c3", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv": "fb3d9c464efc4581a92e45498a4dc77c392572cab676f786552aea5517e62d1b", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv": "430cecb0332ddebe554651279ef9ef20238162edc5af475f9c3de100a044a4b3", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv": "26ba8263aa80ea418176b96e395b6a407fc9f5e59543b9310076b582262b7f96", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv": "53bbb920f4a04367ad7725ef21b2f6c341ddd48a6dba1870159391ebc0f75c4a", + "vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv": "edc1f6a580735a12d5054ccb1333cdff966b1c2040e3140267e356b5cdc13a94", + "vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv": "a632a3e38d867f3dd6d91214f3c73308f0904e8bf2aa9240f38051b5edf32573", + "vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv": "da292964866ad8b0c8b82c676069c27bcc0c2a04c392a00e8484cf49565d63fa", + "vendor/lists/finding_list_translation.csv": "00ca43cdc8ebae362b114ec3ba801d87694026748175839492f38e14b1592863", + "vendor/lists/hardeningkitty_lists_manifest.psd1": "fc2ad9d813ace832d5fc64fef90124123a00497a82bc611d58fa1d0bc3272d71", + "vendor/lists/hardeningkitty_lists_manifest.psd1.p7s": "1508d9eb0f05a778697079f0a821ec34598bd3c02f1c3754213e7cb55f075b38", + "vendor/vendor-manifest.json": "4d4ff0bccc4a4ac358427e7625e46702055cabab61c84728f2bd36e9bfb85362" + }, + "schema_version": 1, + "upstream_commit": "acf9ecee3d044a9337df7aad80e730cbd746e8de" +} diff --git a/setup.py b/setup.py index ff137b6..cacb677 100644 --- a/setup.py +++ b/setup.py @@ -83,7 +83,7 @@ def _checksum(path): def _verify_vendor(root, allow_runtime=False): manifest_path = os.path.join(root, 'vendor-manifest.json') if not os.path.isfile(manifest_path): - raise RuntimeError('Vendor assets missing. Run python tools/vendor_assets.py before building the WAPT package.') + raise RuntimeError('Vendor assets missing from WAPT package (vendor/vendor-manifest.json). Rebuild from prepared sources and verify the resulting .wapt before installation.') manifest = _read_json(manifest_path) if manifest.get('upstream_commit') != 'acf9ecee3d044a9337df7aad80e730cbd746e8de': raise RuntimeError('Vendor manifest does not use the approved pinned revision.') diff --git a/vendor/HardeningKitty.psd1 b/vendor/HardeningKitty.psd1 new file mode 100644 index 0000000..c8dc700 --- /dev/null +++ b/vendor/HardeningKitty.psd1 @@ -0,0 +1,119 @@ +# +# Module manifest for module 'HardeningKitty' +# Generated by: Michael Schneider +# Generated on: 2026-07-21 +# + +@{ + + # Script module or binary module file associated with this manifest. + RootModule = 'HardeningKitty.psm1' + + # Version number of this module. + ModuleVersion = '0.9.5' + + # Supported PSEditions + # CompatiblePSEditions = @() + + # ID used to uniquely identify this module + GUID = '28847a8c-81c8-11f1-bc96-00155d58db47' + + # Author of this module + Author = 'Michael Schneider' + + # Company or vendor of this module + CompanyName = 'scip ag' + + # Copyright statement for this module + Copyright = 'MIT License, Copyright (c) 2017 Michael Schneider' + + # Description of the functionality provided by this module + Description = 'Module to audit and harden Windows machines based on various guidelines' + + # Minimum version of the Windows PowerShell engine required by this module + # PowerShellVersion = '' + + # Name of the Windows PowerShell host required by this module + # PowerShellHostName = '' + + # Minimum version of the Windows PowerShell host required by this module + # PowerShellHostVersion = '' + + # Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only. + # DotNetFrameworkVersion = '' + + # Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only. + # CLRVersion = '' + + # Processor architecture (None, X86, Amd64) required by this module + # ProcessorArchitecture = '' + + # Modules that must be imported into the global environment prior to importing this module + # RequiredModules = @() + + # Assemblies that must be loaded prior to importing this module + # RequiredAssemblies = @() + + # Script files (.ps1) that are run in the caller's environment prior to importing this module. + # ScriptsToProcess = @() + + # Type files (.ps1xml) to be loaded when importing this module + # TypesToProcess = @() + + # Format files (.ps1xml) to be loaded when importing this module + # FormatsToProcess = @() + + # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess + # NestedModules = @() + + # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. + FunctionsToExport = 'Invoke-HardeningKitty' + + # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. + CmdletsToExport = @() + + # Variables to export from this module + VariablesToExport = '*' + + # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export. + AliasesToExport = @() + + # DSC resources to export from this module + # DscResourcesToExport = @() + + # List of all modules packaged with this module + # ModuleList = @() + + # List of all files packaged with this module + # FileList = @() + + # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell. + PrivateData = @{ + + PSData = @{ + + # Tags applied to this module. These help with module discovery in online galleries. + Tags = @("Windows Hardening", "Audit", "Security Baseline", "Security", "Windows", "Defense") + + # A URL to the license for this module. + LicenseUri = 'https://github.com/0x6d69636b/windows_hardening/blob/master/LICENSE' + + # A URL to the main website for this project. + ProjectUri = 'https://github.com/0x6d69636b/windows_hardening' + + # A URL to an icon representing this module. + # IconUri = '' + + # ReleaseNotes of this module + # ReleaseNotes = '' + + } # End of PSData hashtable + + } # End of PrivateData hashtable + + # HelpInfo URI of this module + # HelpInfoURI = '' + + # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. + # DefaultCommandPrefix = '' +} diff --git a/vendor/HardeningKitty.psm1 b/vendor/HardeningKitty.psm1 new file mode 100644 index 0000000..efe7a4e --- /dev/null +++ b/vendor/HardeningKitty.psm1 @@ -0,0 +1,3779 @@ +Function Invoke-HardeningKitty { + + <# + .SYNOPSIS + + Invoke-HardeningKitty - Checks and hardens your Windows configuration + + + =^._.^= + _( )/ HardeningKitty + + + Author: Michael Schneider + License: MIT + Required Dependencies: None + Optional Dependencies: None + + + .DESCRIPTION + + HardeningKitty supports hardening of a Windows system. The configuration of the system is + retrieved and assessed using a finding list. In addition, the system can be hardened according + to predefined values. HardeningKitty reads settings from the registry and uses other modules + to read configurations outside the registry. + + .PARAMETER FileFindingList + + Path to a finding list in CSV format. HardeningKitty has one list each for machine and user settings. + + .PARAMETER Mode + + The mode Config only retrieves the settings, while the mode Audit performs an assessment of the settings. + The mode HailMary hardens the system according to recommendations of the HardeningKitty list. + + .PARAMETER Source + + Defines whether the system is configured using Group Policy (GPO) or Microsoft Intune. The information + gathering process differs between these sources. + + .PARAMETER EmojiSupport + + The use of emoji is activated. The terminal should support this accordingly. Windows Terminal + offers full support. + + .PARAMETER Log + + The logging function is activated. The script output is additionally logged in a file. The file + name is assigned by HardeningKitty itself and the file is stored in the same directory as the script. + + .PARAMETER LogFile + + The name and location of the log file can be defined by the user. + + .PARAMETER Report + + The retrieved settings and their assessment result are stored in CSV format in a machine-readable format. + The file name is assigned by HardeningKitty itself and the file is stored in the same directory as the script. + + .PARAMETER ReportFile + + The name and location of the report file can be defined by the user. + + .PARAMETER Backup + + The retrieved settings and their assessment result are stored in CSV format in a machine-readable format with all value to backup your previous config. + + .PARAMETER SkipMachineInformation + + Information about the system is not queried and displayed. This may be useful while debugging or + using multiple lists on the same system. + + .PARAMETER SkipUserInformation + + Information about the user is not queried and displayed. This may be useful while debugging or + using multiple lists on the same system. + + .PARAMETER SkipLanguageWarning + + Do not show the language warning on an no-english Windows system. + + .PARAMETER SkipRestorePoint + + Do not create a System Restore Point in HailMary mode. HardeningKitty strongly recommends to backup your system before running Hail Mary. However, + creating can be skipped, for example, if HailMary is executed several times in a row. By default, Windows allows a restore point every 24 hours. + Another reason is when HardeningKitty is run as a user and thus lacks privileges. + + .PARAMETER Filter + + The Filter parameter can be used to filter the hardening list. For this purpose the PowerShell ScriptBlock syntax must be used, for example { $_.ID -eq 4505 }. + The following elements are useful for filtering: ID, Category, Name, Method, and Severity. + + .PARAMETER GPOname + + The GPOname parameter defines the name of the GPO policy. + + .PARAMETER AllowCustomList + + Use a finding list that is not verified against the maintainer signature (a custom or modified list) in a write mode (HailMary, GPO). + Running your own list is your own risk. + + .EXAMPLE + Invoke-HardeningKitty -Mode Audit -Log -Report + + HardeningKitty performs an audit, saves the results and creates a log file + + .EXAMPLE + Invoke-HardeningKitty -FileFindingList finding_list_0x6d69636b_user.csv -SkipMachineInformation + + HardeningKitty performs an audit with a specific list and does not show machine information + + .EXAMPLE + Invoke-HardeningKitty -Mode Config -Report -ReportFile C:\tmp\my_hardeningkitty_report.csv + + HardeningKitty uses the default list, and saves the results in a specific file + + .EXAMPLE + Invoke-HardeningKitty -Filter { $_.Severity -eq "Medium" } + + HardeningKitty uses the default list, and checks only tests with the severity Medium + #> + + [CmdletBinding()] + Param ( + + # Definition of the finding list, default is machine setting list + [String] + $FileFindingList, + + # Choose mode, read system config, audit system config, harden system config + [ValidateSet("Audit", "Config", "HailMary", "GPO")] + [String] + $Mode = "Audit", + + # Choose source, Group Policy or Microsoft Intune + [ValidateSet("GPO", "Intune")] + [String] + $Source = "GPO", + + # Activate emoji support for Windows Terminal + [Switch] + $EmojiSupport, + + # Create a log file + [Switch] + $Log, + + # Skip machine information, useful when debugging + [Switch] + $SkipMachineInformation, + + # Skip user information, useful when debugging + [Switch] + $SkipUserInformation, + + # Skip language warning, if you understand the risk + [Switch] + $SkipLanguageWarning, + + # Skip creating a System Restore Point during Hail Mary mode + [Switch] + $SkipRestorePoint, + + # Define name and path of the log file + [String] + $LogFile, + + # Create a report file in CSV format + [Switch] + $Report, + + # Define name and path of the report file + [String] + $ReportFile, + + # Create a backup config file in CSV format + [Switch] + $Backup, + + # Define name and path of the backup file + [String] + $BackupFile, + + # Use PowerShell ScriptBlock syntax to filter the finding list + [scriptblock] + $Filter, + + # Define name of the GPO name + [String] + $GPOname, + + # Use a finding list that is not verified against the maintainer signature + [Switch] + $AllowCustomList + ) + + Function Write-ProtocolEntry { + <# + .SYNOPSIS + Output of an event with timestamp and different formatting + depending on the level. If the Log parameter is set, the + output is also stored in a file. + #> + + [CmdletBinding()] + Param ( + [String] + $Text, + + [String] + $LogLevel + ) + + $Time = Get-Date -Format G + + Switch ($LogLevel) { + "Info" { $Message = "[*] $Time - $Text"; Write-Host $Message; Break } + "Debug" { $Message = "[-] $Time - $Text"; Write-Host -ForegroundColor Cyan $Message; Break } + "Warning" { $Message = "[?] $Time - $Text"; Write-Host -ForegroundColor Yellow $Message; Break } + "Error" { $Message = "[!] $Time - $Text"; Write-Host -ForegroundColor Red $Message; Break } + "Success" { $Message = "[$] $Time - $Text"; Write-Host -ForegroundColor Green $Message; Break } + "Notime" { $Message = "[*] $Text"; Write-Host -ForegroundColor Gray $Message; Break } + Default { $Message = "[*] $Time - $Text"; Write-Host $Message; } + } + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + } + + Function Add-MessageToFile { + <# + .SYNOPSIS + Write message to a file, this function can be used for logs, + reports, backups and more. + #> + + [CmdletBinding()] + Param ( + [String] + $Text, + + [String] + $File + ) + + try { + Add-Content -Path $File -Value $Text -ErrorAction Stop + } catch { + Write-ProtocolEntry -Text "Error while writing log entries into $File. Aborting..." -LogLevel "Error" + Break + } + + } + + Function Write-ResultEntry { + <# + .SYNOPSIS + Output of the assessment result with different formatting + depending on the severity level. If emoji support is enabled, + a suitable symbol is used for the severity rating. + #> + + [CmdletBinding()] + Param ( + + [String] + $Text, + + [String] + $SeverityLevel + ) + + If ($EmojiSupport) { + + Switch ($SeverityLevel) { + + "Passed" { $Emoji = [char]::ConvertFromUtf32(0x1F63A); $Message = "[$Emoji] $Text"; Write-Host -ForegroundColor Gray $Message; Break } + "Low" { $Emoji = [char]::ConvertFromUtf32(0x1F63C); $Message = "[$Emoji] $Text"; Write-Host -ForegroundColor Cyan $Message; Break } + "Medium" { $Emoji = [char]::ConvertFromUtf32(0x1F63F); $Message = "[$Emoji] $Text"; Write-Host -ForegroundColor Yellow $Message; Break } + "High" { $Emoji = [char]::ConvertFromUtf32(0x1F640); $Message = "[$Emoji] $Text"; Write-Host -ForegroundColor Red $Message; Break } + Default { $Message = "[*] $Text"; Write-Host $Message; } + } + + } Else { + + Switch ($SeverityLevel) { + + "Passed" { $Message = "[+] $Text"; Write-Host -ForegroundColor Gray $Message; Break } + "Low" { $Message = "[-] $Text"; Write-Host -ForegroundColor Cyan $Message; Break } + "Medium" { $Message = "[$] $Text"; Write-Host -ForegroundColor Yellow $Message; Break } + "High" { $Message = "[!] $Text"; Write-Host -ForegroundColor Red $Message; Break } + Default { $Message = "[*] $Text"; Write-Host $Message; } + } + } + } + + Function Get-IniContent ($filePath) { + <# + .SYNOPSIS + Read a .ini file into a tree of hashtables + + .NOTES + Original source see https://devblogs.microsoft.com/scripting/use-powershell-to-work-with-any-ini-file/ + #> + + $ini = @{} + switch -regex -file $FilePath { + "^\[(.+)\]" { + # Section + $section = $matches[1] + $ini[$section] = @{} + $CommentCount = 0 + } + "^(;.*)$" { + # Comment + $value = $matches[1] + $CommentCount = $CommentCount + 1 + $name = "Comment" + $CommentCount + $ini[$section][$name] = $value + } + "(.+?)\s*=(.*)" { + # Key + $name, $value = $matches[1..2] + $ini[$section][$name] = $value + } + } + + return $ini + } + + Function Out-IniFile($InputObject, $FilePath, $Encoding) { + <# + .SYNOPSIS + Write a hashtable out to a .ini file + + .NOTES + Original source see https://devblogs.microsoft.com/scripting/use-powershell-to-work-with-any-ini-file/ + #> + + $outFile = New-Item -Force -ItemType file -Path $Filepath + + foreach ($i in $InputObject.keys) { + if (!($($InputObject[$i].GetType().Name) -eq "Hashtable")) { + #No Sections + Add-Content -Encoding $Encoding -Path $outFile -Value "$i=$($InputObject[$i])" + } else { + #Sections + Add-Content -Encoding $Encoding -Path $outFile -Value "[$i]" + Foreach ($j in ($InputObject[$i].keys | Sort-Object)) { + if ($j -match "^Comment[\d]+") { + Add-Content -Encoding $Encoding -Path $outFile -Value "$($InputObject[$i][$j])" + } else { + Add-Content -Encoding $Encoding -Path $outFile -Value "$j=$($InputObject[$i][$j])" + } + } + Add-Content -Encoding $Encoding -Path $outFile -Value "" + } + } + } + + Function Get-HashtableValueDeep { + <# + .SYNOPSIS + Get a value from a tree of hashtables + #> + + [CmdletBinding()] + Param ( + + [Hashtable] + $Table, + + [String] + $Path + ) + + $Key = $Path.Split('\', 2) + + $Entry = $Table[$Key[0]] + + if ($Entry -is [hashtable] -and $Key.Length -eq 1) { + throw "Path is incomplete (expected a leaf but still on a branch)" + } + + if ($Entry -is [hashtable]) { + return Get-HashtableValueDeep $Entry $Key[1]; + } else { + if ($Key.Length -eq 1) { + return $Entry + } else { + throw "Path is too long (expected a branch but arrived at a leaf before the end of the path)" + } + } + } + + Function Set-HashtableValueDeep { + <# + .SYNOPSIS + Set a value in a tree of hashtables, using recursion. + #> + + [CmdletBinding()] + Param ( + [Hashtable] + $Table, + + [String] + $Path, + + [String] + $Value + ) + + $Key = $Path.Split('\', 2) + + $Entry = $Table[$Key[0]] + + if ($Key.Length -eq 2) { + if ($null -eq $Entry) { + $Table[$Key[0]] = @{} + } elseif ($Entry -isnot [hashtable]) { + throw "Not hashtable" + } + + return Set-HashtableValueDeep -Table $Table[$Key[0]] -Path $Key[1] -Value $Value; + } elseif ($Key.Length -eq 1) { + $Table[$Key[0]] = $Value; + } + } + + Function Get-SidFromAccount { + <# + .SYNOPSIS + Translate the account name (user or group) into the Security Identifier (SID) + #> + + [CmdletBinding()] + Param ( + + [String] + $AccountName + ) + + try { + + $AccountObject = New-Object System.Security.Principal.NTAccount($AccountName) + $AccountSid = $AccountObject.Translate([System.Security.Principal.SecurityIdentifier]).Value + + } catch { + + # If translation fails, return account name + $AccountSid = $AccountName + } + + Return $AccountSid + } + + Function Get-AccountFromSid { + <# + .SYNOPSIS + Translate the Security Identifier (SID) into the account name (user or group) + #> + + [CmdletBinding()] + Param ( + + [String] + $AccountSid + ) + + try { + + $AccountObject = New-Object System.Security.Principal.SecurityIdentifier ($AccountSid) + $AccountName = $AccountObject.Translate([System.Security.Principal.NTAccount]).Value + + } catch { + + # If translation fails, return account SID + $AccountName = $AccountSid + } + + Return $AccountName + } + + Function Translate-SidFromWellkownAccount { + <# + .SYNOPSIS + Translate the well-known account name (user or group) into the Security Identifier (SID) + No attempt is made to get a Domain SID to identify groups such as Domain Admins, + as the possibility for false positives is too great. In this case the account name is returned. + #> + + [CmdletBinding()] + Param ( + + [String] + $AccountName + ) + + # Get Computer SID and set well-known local user SID + $ComputerSid = ((Get-LocalUser | Select-Object -First 1).SID).AccountDomainSID.ToString() + $LocalAdminSid = $ComputerSid + "-500" + $LocalGuestSid = $ComputerSid + "-501" + + Switch ($AccountName) { + "Administrator" { $AccountSid = $LocalAdminSid; Break } + "Guest" { $AccountSid = $LocalGuestSid; Break } + "BUILTIN\Account Operators" { $AccountSid = "S-1-5-32-548"; Break } + "BUILTIN\Administrators" { $AccountSid = "S-1-5-32-544"; Break } + "BUILTIN\Backup Operators" { $AccountSid = "S-1-5-32-551"; Break } + "BUILTIN\Guests" { $AccountSid = "S-1-5-32-546"; Break } + "BUILTIN\Power Users" { $AccountSid = "S-1-5-32-547"; Break } + "BUILTIN\Print Operators" { $AccountSid = "S-1-5-32-550"; Break } + "BUILTIN\Remote Desktop Users" { $AccountSid = "S-1-5-32-555"; Break } + "BUILTIN\Server Operators" { $AccountSid = "S-1-5-32-549"; Break } + "BUILTIN\Users" { $AccountSid = "S-1-5-32-545"; Break } + "Everyone" { $AccountSid = "S-1-1-0"; Break } + "NT AUTHORITY\ANONYMOUS LOGON" { $AccountSid = "S-1-5-7"; Break } + "NT AUTHORITY\Authenticated Users" { $AccountSid = "S-1-5-11"; Break } + "NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS" { $AccountSid = "S-1-5-9"; Break } + "NT AUTHORITY\IUSR" { $AccountSid = "S-1-5-17"; Break } + "NT AUTHORITY\Local account and member of Administrators group" { $AccountSid = "S-1-5-114"; Break } + "NT AUTHORITY\Local account" { $AccountSid = "S-1-5-113"; Break } + "NT AUTHORITY\LOCAL SERVICE" { $AccountSid = "S-1-5-19"; Break } + "NT AUTHORITY\NETWORK SERVICE" { $AccountSid = "S-1-5-20"; Break } + "NT AUTHORITY\SERVICE" { $AccountSid = "S-1-5-6"; Break } + "NT AUTHORITY\SYSTEM" { $AccountSid = "S-1-5-18"; Break } + "NT SERVICE\WdiServiceHost" { $AccountSid = "S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420"; Break } + "NT VIRTUAL MACHINE\Virtual Machines" { $AccountSid = "S-1-5-83-0"; Break } + "RESTRICTED SERVICES\PrintSpoolerService" { $AccountSid = "S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229"; Break } + "Window Manager\Window Manager Group" { $AccountSid = "S-1-5-90-0"; Break } + Default { $AccountSid = $AccountName } + } + + Return $AccountSid + } + + Function Write-NotAdminError { + [CmdletBinding()] + param ( + [String] + $FindingID, + [String] + $FindingName, + [string] + $FindingMethod + ) + + $Script:StatsError++ + $Message = "ID " + $FindingID + ", " + $FindingName + ", Method " + $FindingMethod + " requires admin privileges. Test skipped." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + } + + Function Write-BinaryError { + [CmdletBinding()] + param ( + [String] + $Binary, + [String] + $FindingID, + [String] + $FindingName, + [string] + $FindingMethod + ) + $Script:StatsError++ + $Message = "ID " + $FindingID + ", " + $FindingName + ", Method " + $FindingMethod + " requires $Binary and it was not found. Test skipped." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + } + + Function New-HardeningKittyTempDirectory { + <# + .SYNOPSIS + Create a private working directory for temporary files. + + .DESCRIPTION + This function creates a dedicated directory with a random name and an ACL restricted to + the current user (inheritance disabled), so temporary files cannot be pre-created, + tampered with or read by other users. This protects the auditpol backup and the secedit exports + which contain security configuration information. + #> + + $TempPath = [System.IO.Path]::GetTempPath() + Do { + $DirectoryPath = Join-Path -Path $TempPath -ChildPath ("HardeningKitty_" + [System.IO.Path]::GetRandomFileName()) + } Until (-Not (Test-Path -LiteralPath $DirectoryPath)) + + $Directory = New-Item -Path $DirectoryPath -ItemType Directory -ErrorAction Stop + + # Restrict access to the current user and remove inherited permissions + $CurrentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User + $Acl = Get-Acl -Path $Directory.FullName + $Acl.SetAccessRuleProtection($true, $false) + $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule( + $CurrentUser, + [System.Security.AccessControl.FileSystemRights]::FullControl, + ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit), + [System.Security.AccessControl.PropagationFlags]::None, + [System.Security.AccessControl.AccessControlType]::Allow + ) + $Acl.AddAccessRule($AccessRule) + + # secedit.exe /configure opens its database through the Security Configuration Engine, + # which runs as SYSTEM. Without this rule it fails with "Access is denied" (issue #214). + $SystemSid = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::LocalSystemSid, $null) + $AccessRuleSystem = New-Object System.Security.AccessControl.FileSystemAccessRule( + $SystemSid, + [System.Security.AccessControl.FileSystemRights]::FullControl, + ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit), + [System.Security.AccessControl.PropagationFlags]::None, + [System.Security.AccessControl.AccessControlType]::Allow + ) + $Acl.AddAccessRule($AccessRuleSystem) + Set-Acl -Path $Directory.FullName -AclObject $Acl + + Return $Directory.FullName + } + + Function New-HardeningKittyTempFile { + <# + .SYNOPSIS + Return a path to a uniquely named temporary file inside the private + HardeningKitty working directory. + + .DESCRIPTION + The random file name comes from a cryptographically strong source. With + -CreateFile an empty file is created, mirroring the GetTempFileName() behaviour. + Without it only a path is returned, which is required by auditpol.exe + as it refuses to back up into an existing file. -Extension replaces the + random extension, e.g. ".sdb" for a secedit.exe database. + #> + + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [String] + $Directory, + [Switch] + $CreateFile, + [String] + $Extension + ) + Do { + $FileName = [System.IO.Path]::GetRandomFileName() + If ($Extension) { + $FileName = [System.IO.Path]::ChangeExtension($FileName, $Extension) + } + $FilePath = Join-Path -Path $Directory -ChildPath $FileName + } Until (-Not (Test-Path -LiteralPath $FilePath)) + If ($CreateFile) { + New-Item -Path $FilePath -ItemType File -ErrorAction Stop | Out-Null + } + Return $FilePath + } + + Function Confirm-FindingListIntegrity { + <# + .SYNOPSIS + Verify a finding list against the signed official manifest. + + .DESCRIPTION + Official finding lists are attested by lists\hardeningkitty_lists_manifest.psd1, which + maps each official list file name to its SHA-256 hash and is signed with a detached + PKCS#7 signature (hardeningkitty_lists_manifest.psd1.p7s) by the maintainer certificate. + + A list is "verified" when the detached signature is intact, the signer thumbprint matches + the pinned thumbprint, and the list SHA-256 matches the manifest entry for its name. + + The signature is checked with SignedCms.CheckSignature($true), which validates signature + integrity only and deliberately ignores the certificate chain and validity period. The + trust anchor is the pinned thumbprint, not a public CA, so a self-signed certificate is + sufficient and no timestamp is required. + + This function never throws; it always returns a status object with the properties + Verified (bool), Reason (string) and Hash (string, SHA-256 of the list). + #> + + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [String] + $ListPath, + [Parameter(Mandatory = $true)] + [String] + $ManifestPath, + [Parameter(Mandatory = $true)] + [String] + $SignaturePath, + [String] + $PinnedThumbprint + ) + + $Hash = "" + + try { + + # Hash of the list under test (reported even when verification fails) + If (Test-Path -LiteralPath $ListPath) { + $Hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $ListPath).Hash + } + + # Trust anchor must be configured + If ([String]::IsNullOrWhiteSpace($PinnedThumbprint) -or $PinnedThumbprint -eq "REPLACE_WITH_MAINTAINER_CERT_THUMBPRINT") { + Return [pscustomobject] @{ Verified = $false; Reason = "signing thumbprint not configured"; Hash = $Hash } + } + + # Manifest and detached signature must be present + If (-Not (Test-Path -LiteralPath $ManifestPath) -or -Not (Test-Path -LiteralPath $SignaturePath)) { + Return [pscustomobject] @{ Verified = $false; Reason = "signed manifest not found"; Hash = $Hash } + } + + # The PKCS#7/CMS types (SignedCms, ContentInfo) live in the System.Security assembly, + # which is not loaded by default on Windows PowerShell 5.1 (already present on PS 7). + If (-not ([System.Management.Automation.PSTypeName]'System.Security.Cryptography.Pkcs.SignedCms').Type) { + Add-Type -AssemblyName System.Security + } + + # Verify the detached PKCS#7 signature over the manifest bytes (integrity only) + $ManifestBytes = [System.IO.File]::ReadAllBytes($ManifestPath) + $SignatureBytes = [System.IO.File]::ReadAllBytes($SignaturePath) + $ContentInfo = New-Object System.Security.Cryptography.Pkcs.ContentInfo(, $ManifestBytes) + $SignedCms = New-Object System.Security.Cryptography.Pkcs.SignedCms($ContentInfo, $true) + $SignedCms.Decode($SignatureBytes) + $SignedCms.CheckSignature($true) + + # Signer must be the pinned maintainer certificate + $SignerThumbprint = $SignedCms.SignerInfos[0].Certificate.Thumbprint + If ($SignerThumbprint -ne $PinnedThumbprint) { + Return [pscustomobject] @{ Verified = $false; Reason = "manifest signed by an untrusted certificate"; Hash = $Hash } + } + + # The manifest content is trustworthy only now that its signature is verified + $Manifest = Import-PowerShellDataFile -Path $ManifestPath + $ListName = Split-Path -Path $ListPath -Leaf + $ExpectedHash = $Manifest.Lists[$ListName] + + If ([String]::IsNullOrEmpty($ExpectedHash)) { + Return [pscustomobject] @{ Verified = $false; Reason = "not an official list"; Hash = $Hash } + } + If ($ExpectedHash -ne $Hash) { + Return [pscustomobject] @{ Verified = $false; Reason = "list content does not match the signed manifest"; Hash = $Hash } + } + + Return [pscustomobject] @{ Verified = $true; Reason = "official"; Hash = $Hash } + + } catch { + Return [pscustomobject] @{ Verified = $false; Reason = "verification error: $($_.Exception.Message)"; Hash = $Hash } + } + } + + Function ConvertToInt { + [CmdletBinding()] + Param ( + + [String] + $string + ) + $int64 = $null + $int32 = $null + + # Attempt to parse the string as an Int32 + if ([Int32]::TryParse($string, [ref]$int32)) { + return $int32 + } + + # Attempt to parse the string as an Int64 + if ([Int64]::TryParse($string, [ref]$int64)) { + return $int64 + } + + # If the string cannot be parsed as either an Int32 or an Int64, throw an error + throw "Cannot convert string '$string' to an integer." + } + + Function Get-IntuneResult { + # Check if the finding list has an Intune setting + If ([string]::IsNullOrEmpty($Finding.RegistryPathIntune)) { + $Result = "NotSupported" + } Else { + # Intune user policy settings contain a SID value, we need to replace it + # We get the value from the registry, as the SID must not match the current user's SID + If ([string] $Finding.RegistryPathIntune.contains("{SID}") -or [string] $Finding.RegistryPathDCP.contains("{SID}")) { + $FindingUserSIDPath = Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\" | Select-String -Pattern "S-1" + $FindingUserSID = $FindingUserSIDPath.ToString().Trim().Split("\") + # Replace SID in Intune path + If ([string] $Finding.RegistryPathIntune.contains("{SID}")){ + $FindingRegistryPathIntuneUser = $($Finding.RegistryPathIntune).Replace("{SID}",$FindingUserSID[5]) + $FindingRegistryPathIntune = $FindingRegistryPathIntuneUser + } + # Replace SID in DCP path + If ([string] $Finding.RegistryPathDCP.contains("{SID}")){ + $FindingRegistryPathDCPUser = $($Finding.RegistryPathDCP).Replace("{SID}",$FindingUserSID[5]) + $FindingRegistryPathDCP = $FindingRegistryPathDCPUser + } + } Else { + $FindingRegistryPathIntune = $Finding.RegistryPathIntune + $FindingRegistryPathDCP = $Finding.RegistryPathDCP + } + # Check if HardeningKitty needs to get the WinningProvider + If ([string]::IsNullOrEmpty($FindingRegistryPathDCP)) { + # Get result directly + If (Test-Path -Path $FindingRegistryPathIntune) { + try { + $Result = Get-ItemPropertyValue -Path $FindingRegistryPathIntune -Name $Finding.RegistryItemIntune + } catch { + $Result = "NotConfigured" + } + } Else { + $Result = "PathNotExists" + } + } Else { + # Check if policy enabled + If (Test-Path -Path $FindingRegistryPathDCP) { + try { + # Get the WinningProvider + $FindingWinningProvider = $Finding.RegistryItemIntune + "_WinningProvider" + $WinningProvider = Get-ItemPropertyValue -Path $FindingRegistryPathDCP -Name $FindingWinningProvider + # Use the WinningProvider and get the result + $FindingRegistryPathIntune = $($FindingRegistryPathIntune).Replace("{GUID}",$WinningProvider) + If (Test-Path -Path $FindingRegistryPathIntune) { + try { + $Result = Get-ItemPropertyValue -Path $FindingRegistryPathIntune -Name $Finding.RegistryItemIntune + } catch { + $Result = "NotConfigured" + } + } Else { + $Result = "WinningProviderNotExists" + } + } catch { + $Result = "NotConfigured" + } + } Else { + $Result = "NotConfigured" + } + } + } + return $Result + } + + # + # Binary Locations + # + $BinarySecedit = "C:\Windows\System32\secedit.exe" + $BinaryAuditpol = "C:\Windows\System32\auditpol.exe" + $BinaryNet = "C:\Windows\System32\net.exe" + $BinaryBcdedit = "C:\Windows\System32\bcdedit.exe" + + # + # Start Main + # + $HardeningKittyVersion = "0.9.5-1792740671" + + # + # Finding list integrity + # + $HardeningKittyListSigningThumbprint = "F47005C8B9BECD8225E13A00A256BEE23DE27673" + $HardeningKittyListManifestName = "hardeningkitty_lists_manifest.psd1" + + # + # Log, report and backup file + # + $Hostname = $env:COMPUTERNAME.ToLower() + $FileDate = Get-Date -Format yyyyMMdd-HHmmss + $WinSystemLocale = Get-WinSystemLocale + $PowerShellVersion = "$($PSVersionTable.PSVersion.Major).$($PSVersionTable.PSVersion.Minor)" + + If ($FileFindingList.Length -eq 0) { + $ListName = "finding_list_0x6d69636b_machine" + } Else { + $ListName = [System.IO.Path]::GetFileNameWithoutExtension($FileFindingList) + } + + If ($Log) { + If ($LogFile.Length -eq 0) { + $LogFile = "hardeningkitty_log_" + $Hostname + "_" + $ListName + "-$FileDate.log" + } ElseIf ($(Split-Path -Path $LogFile).Length -ne 0) { + If ( -Not(Test-Path -Path $(Split-Path $LogFile))) { + $Message = "The path to your log file does not exist." + $Log = $false + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + } + If ($Report) { + If ($ReportFile.Length -eq 0) { + $ReportFile = "hardeningkitty_report_" + $Hostname + "_" + $ListName + "-$FileDate.csv" + } ElseIf ($(Split-Path -Path $ReportFile).Length -ne 0) { + If ( -Not(Test-Path -Path $(Split-Path $ReportFile))) { + $Message = "The path to your report file does not exist." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + } + If ($Backup) { + If ($BackupFile.Length -eq 0) { + $BackupFile = "hardeningkitty_backup_" + $Hostname + "_" + $ListName + "-$FileDate.csv" + } ElseIf ($(Split-Path -Path $BackupFile).Length -ne 0) { + If ( -Not(Test-Path -Path $(Split-Path $BackupFile))) { + $Message = "The path to your backup file does not exist." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + } + $ReportAllResults = @() + $BackupAllResults = @() + + # + # Statistics + # + $StatsPassed = 0 + $StatsLow = 0 + $StatsMedium = 0 + $StatsHigh = 0 + $StatsTotal = 0 + $Script:StatsError = 0 + + # + # Header + # + Write-Output "`n" + Write-Output " =^._.^=" + Write-Output " _( )/ HardeningKitty $HardeningKittyVersion" + Write-Output "`n" + Write-ProtocolEntry -Text "Starting HardeningKitty" -LogLevel "Info" + + # + # Machine information + # + If (-not($SkipMachineInformation)) { + + Write-Output "`n" + Write-ProtocolEntry -Text "Getting machine information" -LogLevel "Info" + + # + # The Get-ComputerInfo cmdlet gets a consolidated object of system + # and operating system properties. This cmdlet was introduced in Windows PowerShell 5.1. + # + If ($PowerShellVersion -le 5.0) { + + try { + + $OperatingSystem = Get-CimInstance Win32_operatingsystem + $ComputerSystem = Get-CimInstance Win32_ComputerSystem + Switch ($ComputerSystem.domainrole) { + "0" { $Domainrole = "Standalone Workstation"; Break } + "1" { $Domainrole = "Member Workstation"; Break } + "2" { $Domainrole = "Standalone Server"; Break } + "3" { $Domainrole = "Member Server"; Break } + "4" { $Domainrole = "Backup Domain Controller"; Break } + "5" { $Domainrole = "Primary Domain Controller"; Break } + } + $Uptime = (Get-Date) - $OperatingSystem.LastBootUpTime + + $Message = "Hostname: " + $OperatingSystem.CSName + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Domain: " + $ComputerSystem.Domain + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Domain role: " + $Domainrole + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Install date: " + $OperatingSystem.InstallDate + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Last Boot Time: " + $OperatingSystem.LastBootUpTime + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Uptime: " + $Uptime + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows: " + $OperatingSystem.Caption + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows version: " + $OperatingSystem.Version + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows build: " + $OperatingSystem.BuildNumber + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "System-locale: " + $WinSystemLocale.Name + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Powershell Version: " + $PowerShellVersion + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + } catch { + Write-ProtocolEntry -Text "Getting machine information failed." -LogLevel "Warning" + } + } Else { + + $MachineInformation = Get-ComputerInfo + $Message = "Hostname: " + $MachineInformation.CsDNSHostName + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Domain: " + $MachineInformation.CsDomain + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Domain role: " + $MachineInformation.CsDomainRole + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Install date: " + $MachineInformation.OsInstallDate + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Last Boot Time: " + $MachineInformation.OsLastBootUpTime + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Uptime: " + $MachineInformation.OsUptime + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows: " + $MachineInformation.OsName + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows edition: " + $MachineInformation.WindowsEditionId + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows version: " + $MachineInformation.WindowsVersion + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Windows build: " + $MachineInformation.WindowsBuildLabEx + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "System-locale: " + $WinSystemLocale.Name + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $Message = "Powershell Version: " + $PowerShellVersion + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + } + } + + # + # Warning for non-english systems + # + If ($WinSystemLocale.Name -ne "en-US" -and -not($SkipLanguageWarning)) { + Write-Output "`n" + Write-ProtocolEntry -Text "Language warning" -LogLevel "Info" + $Message = "HardeningKitty was developed for the system language 'en-US'. This system uses '" + $WinSystemLocale.Name + "' Language-dependent analyses can sometimes produce false results. Please create an issue if this occurs." + Write-ProtocolEntry -Text $Message -LogLevel "Warning" + } + + # + # Intune Warning + # + If ($Source -eq "Intune") { + Write-Output "`n" + Write-ProtocolEntry -Text "Intune warning" -LogLevel "Info" + $Message = "Hello friend, welcome to an adventure. Intune support is still in development and HardeningKitty has a lot of work to do to be able to query and evaluate Intune settings. Since you're already here, please help! Please maintain the finding lists and share information about Intune registry paths and values via discussions or issues. Since Intune support is still under development, do not expect a comprehensive review, the audit mode is not usable until further notice." + Write-ProtocolEntry -Text $Message -LogLevel "Warning" + } + + # + # User information + # + If (-not($SkipUserInformation)) { + Write-Output "`n" + Write-ProtocolEntry -Text "Getting user information" -LogLevel "Info" + + $Message = "Username: " + [Security.Principal.WindowsIdentity]::GetCurrent().Name + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + $IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") + $Message = "Is Admin: " + $IsAdmin + Write-ProtocolEntry -Text $Message -LogLevel "Notime" + } Else { + $IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") + } + + # + # Private working directory + # The auditpol backup and the secedit exports are written here. + # + $HardeningKittyTempDir = New-HardeningKittyTempDirectory + + # + # Start Config/Audit mode + # The processing is done per category of the finding list. + # The finding list defines which module is used and the arguments and recommended values for the test. + # + If ($Mode -eq "Audit" -or $Mode -eq "Config") { + + # A CSV finding list is imported. HardeningKitty has one machine and one user list. + If ($FileFindingList.Length -eq 0) { + + $CurrentLocation = $PSScriptRoot + $DefaultList = "$CurrentLocation\lists\finding_list_0x6d69636b_machine.csv" + + If (Test-Path -Path $DefaultList) { + $FileFindingList = $DefaultList + } Else { + $Message = "The finding list $DefaultList was not found." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Continue + } + } + + $FindingList = Import-Csv -Path $FileFindingList -Delimiter "," + + # Verify the finding list against the signed official manifest. In read modes (Audit, Config) + # this is informational only - nothing is applied to the system. + $ListStatus = Confirm-FindingListIntegrity -ListPath $FileFindingList ` + -ManifestPath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName") ` + -SignaturePath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName.p7s") ` + -PinnedThumbprint $HardeningKittyListSigningThumbprint + If ($ListStatus.Verified) { + Write-ProtocolEntry -Text "Finding list verified as official (signature valid). SHA-256: $($ListStatus.Hash)" -LogLevel "Success" + } Else { + Write-ProtocolEntry -Text "Finding list is custom / unverified ($($ListStatus.Reason)). SHA-256: $($ListStatus.Hash)" -LogLevel "Warning" + } + + If ($Filter) { + $FindingList = $FindingList | Where-Object -FilterScript $Filter + If ($FindingList.Length -eq 0) { + $Message = "Your filter did not return any results, please adjust the filter so that HardeningKitty has something to work with." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + $LastCategory = "" + + ForEach ($Finding in $FindingList) { + + # + # Reset + # + $Result = "" + $ResultDefaultValue = $false + + # + # Category + # + If ($LastCategory -ne $Finding.Category) { + + $Message = "Starting Category " + $Finding.Category + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + $LastCategory = $Finding.Category + } + + # + # Get Registry Item + # Registry entries can be read with a native PowerShell function. The retrieved value is evaluated later. + # If the registry entry is not available, a default value is used. This must be specified in the finding list. + # + If ($Finding.Method -eq 'Registry') { + + If ($Source -eq 'GPO') { + If (Test-Path -Path $Finding.RegistryPath) { + try { + $Result = Get-ItemPropertyValue -Path $Finding.RegistryPath -Name $Finding.RegistryItem + # Join the result with ";" character if result is an array + if ($Result -is [system.array] -and ($Finding.RegistryItem -eq "Machine" -Or $Finding.RegistryItem -eq "EccCurves" -Or $Finding.RegistryItem -eq "NullSessionPipes" -Or $Finding.RegistryItem -eq "NullSessionShares")){ + $Result = $Result -join ";" + } + } catch { + If ($Backup) { + # If an error occurs and the backup mode is enabled, we consider that this policy does not exist + # and put "-NODATA-" as result to identify it as non-existing policy + $Result = "-NODATA-" + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + } Else { + If ($Backup) { + # If this policy does not exist and the backup mode is enabled, we + # put "-NODATA-" as result to identify it as non-existing policy + $Result = "-NODATA-" + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + # Multiline Registry Keys need a semicolon instead of a space + If ($Finding.RegistryItem -eq "Machine") { + $Result = $Result.Replace(";", " ") + } + } + } + } ElseIf ($Source -eq 'Intune') { + $Result = Get-IntuneResult + } + } + + # + # Get secedit policy + # Secedit configures and analyzes system security, results are written + # to a file, which means HardeningKitty must create a temporary file + # and afterwards delete it. HardeningKitty is very orderly. + # + ElseIf ($Finding.Method -eq 'secedit') { + + # Check if Secedit binary is available, skip test if not + If (-Not (Test-Path $BinarySecedit)) { + Write-BinaryError -Binary $BinarySecedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $TempFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -CreateFile + $Area = ""; + + Switch ($Finding.Category) { + "Account Policies" { $Area = "SECURITYPOLICY"; Break } + "Security Options" { $Area = "SECURITYPOLICY"; Break } + } + + &$BinarySecedit /export /cfg $TempFileName /areas $Area | Out-Null + + $Data = Get-IniContent $TempFileName + + $Value = Get-HashtableValueDeep $Data $Finding.MethodArgument + + if ($null -eq $Value) { + $Result = $null + } else { + $Result = $Value -as [int] + } + + Remove-Item $TempFileName + } + + # + # Get Registry List and search for item + # Depending on the registry structure, the value cannot be accessed directly, but must be found within a data structure + # If the registry entry is not available, a default value is used. This must be specified in the finding list. + # + ElseIf ($Finding.Method -eq 'RegistryList') { + + If ($Source -eq 'GPO') { + If (Test-Path -Path $Finding.RegistryPath) { + + try { + $ResultList = Get-ItemProperty -Path $Finding.RegistryPath + + If ($ResultList | Where-Object { $_ -like "*" + $Finding.RegistryItem + "*" }) { + $Result = $Finding.RegistryItem + } Else { + $Result = "-NODATA-" + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } Else { + If ($Backup) { + # If this policy does not exist and the backup mode is enabled, we + # put "-NODATA-" as result to identify it as non-existing policy + $Result = "-NODATA-" + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + } ElseIf ($Source -eq 'Intune') { + $Result = Get-IntuneResult + } + } + + # + # Get Audit Policy + # The output of auditpol.exe is parsed and will be evaluated later. + # The desired value is not output directly, some output lines can be ignored + # and are therefore skipped. If the output changes, the parsing must be adjusted :( + # + ElseIf ($Finding.Method -eq 'auditpol') { + + # Check if Auditpol binary is available, skip test if not + If (-Not (Test-Path $BinaryAuditpol)) { + Write-BinaryError -Binary $BinaryAuditpol -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $SubCategory = $Finding.MethodArgument + + # auditpol.exe does not write a backup into an existing file, so a path is + # generated without creating the file + $TempFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir + &$BinaryAuditpol /backup /file:$TempFileName > $null + + $ResultOutputLoad = Get-Content $TempFileName + foreach ($line in $ResultOutputLoad) { + $table = $line.Split(",") + if ($table[3] -eq $SubCategory) { + + # Translate setting value (works only for English list, so this is workaround) + Switch ($table[6]) { + "0" { $Result = "No Auditing"; Break } + "1" { $Result = "Success"; Break } + "2" { $Result = "Failure"; Break } + "3" { $Result = "Success and Failure"; Break } + } + } + } + + # House cleaning + Remove-Item $TempFileName + Clear-Variable -Name ("ResultOutputLoad", "table") + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Get Account Policy + # The output of net.exe is parsed and will be evaluated later. + # It may be necessary to use the /domain parameter when calling net.exe. + # The values of the user executing the script are read out. These may not match the password policy. + # + ElseIf ($Finding.Method -eq 'accountpolicy') { + + If ($Source -eq 'Intune') { + $Result = Get-IntuneResult + } + + If ($Source -eq 'GPO' -or $Result -eq 'NotSupported') { + + # Check if net binary is available, skip test if not + If (-Not (Test-Path $BinaryNet)) { + Write-BinaryError -Binary $BinaryNet -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = &$BinaryNet accounts + + # "Parse" account policy + Switch ($Finding.Name) { + "Force user logoff how long after time expires" { $ResultOutput[0] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Network security: Force logoff when logon hours expires" { $ResultOutput[0] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Minimum password age" { $ResultOutput[1] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Maximum password age" { $ResultOutput[2] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Minimum password length" { $ResultOutput[3] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Length of password history maintained" { $ResultOutput[4] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Account lockout threshold" { $ResultOutput[5] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Account lockout duration" { $ResultOutput[6] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + "Reset account lockout counter" { $ResultOutput[7] -match '([a-zA-Z:, /-]+) ([a-z0-9, ]+)' | Out-Null; $Result = $Matches[2]; Break } + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + } + # + # Get Local Account Information + # The PowerShell function Get-LocalUser is used for this. + # In order to get the correct user, the query is made via the SID, + # the base value of the computer must first be retrieved. + # + ElseIf ($Finding.Method -eq 'localaccount') { + + try { + + # Get Computer SID + $ComputerSid = ((Get-LocalUser | Select-Object -First 1).SID).AccountDomainSID.ToString() + + # Get User Status + $Sid = $ComputerSid + "-" + $Finding.MethodArgument + $ResultOutput = Get-LocalUser -SID $Sid + + If ($Finding.Name.Contains("account status")) { + $Result = $ResultOutput.Enabled + } ElseIf ($Finding.Name.Contains("Rename")) { + $Result = $ResultOutput.Name + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # User Rights Assignment + # This method was first developed with the tool accessck.exe, hence the name. + # Due to compatibility problems in languages other than English, secedit.exe is + # now used to read the User Rights Assignments. + # + # Secedit configures and analyzes system security, results are written + # to a file, which means HardeningKitty must create a temporary file + # and afterwards delete it. HardeningKitty is very orderly. + # + ElseIf ($Finding.Method -eq 'accesschk') { + + # Check if Secedit binary is available, skip test if not + If (-Not (Test-Path $BinarySecedit)) { + Write-BinaryError -Binary $BinarySecedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $Area = "USER_RIGHTS" + $TempFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -CreateFile + + try { + + &$BinarySecedit /export /cfg $TempFileName /areas $Area | Out-Null + # -SimpleMatch: MethodArgument comes from the finding list and must be treated + # as literal text, not a regular expression + $ResultOutputRaw = Get-Content -Encoding unicode $TempFileName | Select-String -SimpleMatch $Finding.MethodArgument + + If ($null -eq $ResultOutputRaw) { + $Result = "" + } Else { + $ResultOutputList = $ResultOutputRaw.ToString().split("=").Trim() + $Result = $ResultOutputList[1] -Replace "\*", "" + $Result = $Result -Replace ",", ";" + } + + } catch { + # If secedit did not work, throw an error instead of using the DefaultValue + $Script:StatsError++ + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", secedit.exe could not read the configuration. Test skipped." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Continue + } + + Remove-Item $TempFileName + } + + # + # Windows Optional Feature + # Yay, a native PowerShell function! The status of the feature can easily be read out directly. + # + ElseIf ($Finding.Method -eq 'WindowsOptionalFeature') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = Get-WindowsOptionalFeature -Online -FeatureName $Finding.MethodArgument + $Result = $ResultOutput.State + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Get CimInstance and search for item + # Via a CIM instance classes can be read from the CIM server. + # Afterwards, you have to search for the correct property within the class. + # + ElseIf ($Finding.Method -eq 'CimInstance') { + + try { + + $ResultList = Get-CimInstance -ClassName $Finding.ClassName -Namespace $Finding.Namespace + $Property = $Finding.Property + + If ($ResultList.$Property | Where-Object { $_ -like "*" + $Finding.RecommendedValue + "*" }) { + $Result = $Finding.RecommendedValue + } Else { + $Result = "Not available" + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # BitLocker Drive Encryption + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + ElseIf ($Finding.Method -eq 'BitLockerVolume') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = Get-BitLockerVolume -MountPoint $Env:SystemDrive + If ($ResultOutput.VolumeType -eq 'OperatingSystem') { + $ResultArgument = $Finding.MethodArgument + $Result = $ResultOutput.$ResultArgument + } Else { + $Result = "Manual check required" + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # PowerShell Language Mode + # This is a single purpose function, the desired configuration is output directly. + # + ElseIf ($Finding.Method -eq 'LanguageMode') { + + try { + + $ResultOutput = $ExecutionContext.SessionState.LanguageMode + $Result = $ResultOutput + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Microsoft Defender Status + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + ElseIf ($Finding.Method -eq 'MpComputerStatus') { + + try { + + $ResultOutput = Get-MpComputerStatus + $ResultArgument = $Finding.MethodArgument + $Result = $ResultOutput.$ResultArgument + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Microsoft Defender Preferences + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + ElseIf ($Finding.Method -eq 'MpPreference') { + + try { + + $ResultOutput = Get-MpPreference + $ResultArgument = $Finding.MethodArgument + $Result = $ResultOutput.$ResultArgument + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Microsoft Defender Preferences - Attack surface reduction rules (ASR rules) + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + ElseIf ($Finding.Method -eq 'MpPreferenceAsr') { + + try { + + $ResultOutput = Get-MpPreference + $ResultAsrIds = $ResultOutput.AttackSurfaceReductionRules_Ids + $ResultAsrActions = $ResultOutput.AttackSurfaceReductionRules_Actions + $Result = $Finding.DefaultValue + $Counter = 0 + + ForEach ($AsrRule in $ResultAsrIds) { + + If ($AsrRule -eq $Finding.MethodArgument) { + $Result = $ResultAsrActions[$Counter] + Continue + } + $Counter++ + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Microsoft Defender Preferences - Exclusion lists + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + ElseIf ($Finding.Method -eq 'MpPreferenceExclusion') { + + # Check if the user has admin rights, skip test if not + # Normal users are not allowed to get exclusions + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = Get-MpPreference + $ExclusionType = $Finding.MethodArgument + $ResultExclusions = $ResultOutput.$ExclusionType + + ForEach ($Exclusion in $ResultExclusions) { + $Result += $Exclusion + ";" + } + # Remove last character + $Result = $Result -replace ".$" + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Exploit protection (System) + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # Since the object has several dimensions and there is only one dimension + # in the finding list (lazy) a workaround with split must be done... + # + ElseIf ($Finding.Method -eq 'Processmitigation') { + + try { + + $ResultOutput = Get-ProcessMitigation -System + $ResultArgumentArray = $Finding.MethodArgument.Split(".") + $ResultArgument0 = $ResultArgumentArray[0] + $ResultArgument1 = $ResultArgumentArray[1] + $Result = $ResultOutput.$ResultArgument0.$ResultArgument1 + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Exploit protection (Application) + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # Since the object has several dimensions and there is only one dimension + # in the finding list (lazy) a workaround with split must be done... + # + ElseIf ($Finding.Method -eq 'ProcessmitigationApplication') { + + try { + + $ResultArgumentArray = $Finding.MethodArgument.Split("/") + $ResultOutput = Get-ProcessMitigation -Name $ResultArgumentArray[0] + $ResultArgument0 = $ResultArgumentArray[1] + $ResultArgument1 = $ResultArgumentArray[2] + $Result = $ResultOutput.$ResultArgument0.$ResultArgument1 + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # bcdedit + # Again, the output of a tool must be searched and parsed. Ugly... + # + ElseIf ($Finding.Method -eq 'bcdedit') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if Bcdedit binary is available, skip test if not + If (-Not (Test-Path $BinaryBcdedit)) { + Write-BinaryError -Binary $BinaryBcdedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = &$BinaryBcdedit + $ResultOutput = $ResultOutput | Where-Object { $_ -like "*" + $Finding.RecommendedValue + "*" } + + If ($ResultOutput -match ' ([a-z,A-Z]+)') { + $Result = $Matches[1] + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # FirewallRule + # Search for a specific firewall rule with a given name + # + ElseIf ($Finding.Method -eq 'FirewallRule') { + + try { + + $ResultOutput = Get-NetFirewallRule -PolicyStore ActiveStore -DisplayName $Finding.Name 2> $null + $Result = $ResultOutput.Enabled + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Service + # Check the status of a service + # + ElseIf ($Finding.Method -eq 'service') { + + try { + + $ResultOutput = Get-Service -Name $Finding.MethodArgument 2> $null + + # Use only processes, not drivers + # https://learn.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicetype + If ($ResultOutput.ServiceType.value__ -ge 16) { + $Result = $ResultOutput.StartType + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Scheduled Task + # Check the status of a scheduled task + # + ElseIf ($Finding.Method -eq 'ScheduledTask') { + + try { + + $ResultOutput = Get-ScheduledTask -TaskName $Finding.MethodArgument 2> $null + $Result = $ResultOutput.State + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + + # + # Compare result value and recommendation + # The finding list specifies the test, as well as the recommended values. + # There are two output formats, one for command line output and one for the CSV file. + # + If ($Mode -eq "Audit") { + + # + # User Right Assignment + # For multilingual support, a SID translation takes place and then the known SID values are compared with each other. + # The results are already available as SID (from secedit) and therefore the specifications are now also translated and still sorted. + # + If ($Finding.Method -eq 'accesschk') { + + $SaveRecommendedValue = $Finding.RecommendedValue + + If ($Result -ne '') { + + $ListRecommended = $Finding.RecommendedValue.Split(";") + $ListRecommendedSid = @() + + # SID Translation + ForEach ($AccountName in $ListRecommended) { + $AccountSid = Translate-SidFromWellkownAccount -AccountName $AccountName + $ListRecommendedSid += $AccountSid + } + # Sort SID List + $ListRecommendedSid = $ListRecommendedSid | Sort-Object + + # Build String + ForEach ($AccountName in $ListRecommendedSid) { + [String] $RecommendedValueSid += $AccountName + ";" + } + + $RecommendedValueSid = $RecommendedValueSid -replace ".$" + $Finding.RecommendedValue = $RecommendedValueSid + Clear-Variable -Name ("RecommendedValueSid") + } + } + + # + # Exception handling for special registry keys + # Machine => Network access: Remotely accessible registry paths + # Hardened UNC Paths => Remove spaces in result and recommendation only if result is not null or empty + # + If ($Source -eq "GPO") { + If ($Finding.Method -eq 'Registry' -and $Finding.RegistryItem -eq "Machine") { + # $Finding.RecommendedValue = $Finding.RecommendedValue.Replace(";", " ") + } ElseIf ($Finding.Method -eq 'Registry' -and $Finding.RegistryPath -eq "HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths") { + If (![string]::IsNullOrEmpty($Result)) { + $Result = $Result.Replace(" ", "") + } + $Finding.RecommendedValue = $Finding.RecommendedValue.Replace(" ", "") + } + } + + # + # Handling for registry keys with an "advanced" format + # + + # Define list of registry items + $RegistryItemCollection = @("ConfigureRpcConnectionPolicy", "ConfigureRpcListenerPolicy", "CSE_Registry", "CSE_Security", "PointAndPrintRestrictions", + "SpecifyMaximumFileSizeApplicationLog", "SpecifyMaximumFileSizeSecurityLog", "SpecifyMaximumFileSizeSystemLog", "Channel_LogMaxSize_3" ) + + # Go through all the special cases that require additional handling + If ($Source -eq "Intune" -and $Finding.Method -eq 'Registry' -and $Finding.RegistryItemIntune -eq "AttackSurfaceReductionRules") { + # + # ASR rules + # + If ($Finding.RegistryItem -eq "ExploitGuard_ASR_Rules") { + # There is no Intune setting for generally enabled ASR rules, if something is configured, HardeningKitty assumes it is in use + If ($Result.Length -gt 0) { + $Result = 1 + } + } Else { + # Going through ASR rules + try { + $ResultAsr = $Result.Split("|") + ForEach ($AsrRow in $ResultAsr) { + $AsrRule = $AsrRow.Split("=") + If ($AsrRule[0] -eq $Finding.RegistryItem) { + $Result = $AsrRule[1] + Break + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + } + } ElseIf ($Source -eq "Intune" -and $Finding.Method -eq 'Registry' -and $Finding.RegistryItemIntune -eq "HardenedUNCPaths") { + # + # Hardened UNC path + # Intune uses  as a delimiter to configure multiple paths + # All UNC paths are in the value parameter of the "Pol_HardenedPaths" data id + # + $Delimiter = [char]::ConvertFromUtf32(0xF000) + If ($Result.contains($Delimiter)) { + $PreviousValue = "" + try { + # Finding list contains path and the recommend configuration + $RecommendedValue = $Finding.RecommendedValueIntune.Split(";") + # Convert raw Intune value into XML, and separate the components + $XmlString = "$Result" + $XmlObject = [xml]$XmlString + $UncPaths = $XmlObject.root.data.value.Split($Delimiter) + # The path configuration is in the element before the path in the array + ForEach ($UncPath in $UncPaths) { + If ($UncPath -eq $RecommendedValue[0]) { + $Result = $RecommendedValue[0]+";"+$PreviousValue + Break + } + $PreviousValue = $UncPath + } + } catch { + # If something goes wrong or Intune output is unexpected + $Result = "NotConfigured" + } + } + } ElseIf ($Source -eq "Intune" -and $Finding.RegistryItemIntune -eq "PreventInstallationOfMatchingDeviceSetupClasses") { + # + # Prevent installation of devices using drivers that match an device setup class + # + try { + # Finding list contains id and the recommend configuration + $RecommendedValue = $Finding.RecommendedValueIntune.Split(";") + + # Check if setting is enabled + If ($RecommendedValue[0] -eq "PreventInstallationOfMatchingDeviceSetupClasses") { + If ($Result.StartsWith("" + } Else { + $Result = $RecommendedValue[0]+";" + } + # Go through additional configuration + } Else { + # Convert raw Intune value to XML + $XmlString = "$Result" + $XmlObject = [xml]$XmlString + + ForEach ($row in $XmlObject.root) { + # Check if retroactive mode is active + If ($RecommendedValue[0] -eq "DeviceInstall_Classes_Deny_Retroactive") { + If ($row.data.id -eq $RecommendedValue[0]) { + If ($row.data.value -eq $RecommendedValue[1]) { + $Result = $RecommendedValue[0]+";true" + Break + } + } + # Check list of device classes + } ElseIf ($RecommendedValue[0] -eq "DeviceInstall_Classes_Deny_List") { + If ($row.data.id -eq $RecommendedValue[0]) { + # Intune uses  as a delimiter to configure multiple classes + $Delimiter = [char]::ConvertFromUtf32(0xF000) + $DenyList = $row.data.value.Split($Delimiter) + # Go through list of device classes + ForEach ($entry in $DenyList) { + If ($entry -eq $RecommendedValue[1]) { + $Result = $RecommendedValue[0]+";"+$entry + Break + } Else { + $Result = $RecommendedValue[0]+";{NotFound}" + } + } + } + } + } + } + } catch { + # If something goes wrong or Intune output is unexpected + $Result = "NotConfigured" + } + } ElseIf ($Source -eq "Intune" -and $Finding.Method -eq 'Registry' -and $Finding.RegistryItemIntune -in $RegistryItemCollection) { + # + # Parse the Intune settings in "XML" format to retrieve a specific item/configuration + # + try { + $XmlString = "$Result" + $XmlObject = [xml]$XmlString + ForEach ($row in $XmlObject.root.data) { + If ([string]$row.id.Equals($Finding.MethodArgument)) { + $Result = $row.value + Break + } + } + } catch { + # If something goes wrong or Intune output is unexpected + $Result = "NotConfigured" + } + } + + # + # Compare the result with the recommendation + # + $ResultPassed = $false + If ($Source -eq "Intune" -and ($Finding.Method -eq "Registry" -or $Finding.Method -eq "RegistryList")) { + Switch ($Finding.OperatorIntune) { + "=" { If ([string] $Result -eq $Finding.RecommendedValueIntune) { $ResultPassed = $true }; Break } + "<=" { try { If ([int]$Result -le [int]$Finding.RecommendedValueIntune) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + "<=!0" { try { If ([int]$Result -le [int]$Finding.RecommendedValueIntune -and [int]$Result -ne 0) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + ">=" { try { If ([int]$Result -ge [int]$Finding.RecommendedValueIntune) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + "contains" { If ($Result.ToString().Contains($Finding.RecommendedValueIntune)) { $ResultPassed = $true }; Break } + "notcontains" { If (-not($Result.ToString().Contains($Finding.RecommendedValueIntune))) { $ResultPassed = $true }; Break } + "!=" { If ([string] $Result -ne $Finding.RecommendedValueIntune) { $ResultPassed = $true }; Break } + "=|0" { try { If ([string]$Result -eq $Finding.RecommendedValueIntune -or $Result.Length -eq 0) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + } + } Else { + Switch ($Finding.Operator) { + "=" { If ([string] $Result -eq $Finding.RecommendedValue) { $ResultPassed = $true }; Break } + "<=" { try { If ([int]$Result -le [int]$Finding.RecommendedValue) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + "<=!0" { try { If ([int]$Result -le [int]$Finding.RecommendedValue -and [int]$Result -ne 0) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + ">=" { try { If ([int]$Result -ge [int]$Finding.RecommendedValue) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + "contains" { If ($Result.ToString().Contains($Finding.RecommendedValue)) { $ResultPassed = $true }; Break } + "notcontains" { If (-not($Result.ToString().Contains($Finding.RecommendedValue))) { $ResultPassed = $true }; Break } + "!=" { If ([string] $Result -ne $Finding.RecommendedValue) { $ResultPassed = $true }; Break } + "=|0" { try { If ([string]$Result -eq $Finding.RecommendedValue -or $Result.Length -eq 0) { $ResultPassed = $true } } catch { $ResultPassed = $false }; Break } + } + } + + # + # Restore Result after SID translation + # The results are already available as SID, for better readability they are translated into their names + # + If ($Finding.Method -eq 'accesschk') { + + If ($Result -ne "") { + + $ListResult = $Result.Split(";") + ForEach ($AccountSid in $ListResult) { + $AccountName = Get-AccountFromSid -AccountSid $AccountSid + [String] $ResultName += $AccountName.Trim() + ";" + } + $ResultName = $ResultName -replace ".$" + $Result = $ResultName + Clear-Variable -Name ("ResultName") + } + + $Finding.RecommendedValue = $SaveRecommendedValue + } + + If ($ResultPassed) { + # Passed + $TestResult = "Passed" + If ($Source -eq "Intune" -and ($Finding.Method -eq "Registry" -or $Finding.Method -eq "RegistryList")) { + $MessageRecommendedValue = $Finding.RecommendedValueIntune + } Else { + $MessageRecommendedValue = $Finding.RecommendedValue + } + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", Result=$Result, Recommended=" + $MessageRecommendedValue + ", Severity=Passed" + Write-ResultEntry -Text $Message -SeverityLevel "Passed" + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = "Passed" + Result = $Result + Recommended = $MessageRecommendedValue + TestResult = $TestResult + SeverityFinding = $Finding.Severity + DefaultValue = $ResultDefaultValue + Filter = $Finding.Filter + } + $ReportAllResults += $ReportResult + } + + # Increment Counter + $StatsPassed++ + + } Else { + # Failed + $TestResult = "Failed" + If ($Source -eq "Intune" -and $Finding.Method -eq "Registry") { + $MessageRecommendedValue = $Finding.RecommendedValueIntune + $FindingOperator = $Finding.OperatorIntune + } Else { + $MessageRecommendedValue = $Finding.RecommendedValue + $FindingOperator = $Finding.Operator + } + If ($FindingOperator -eq "!=") { + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", Result=$Result, Recommended=Not " + $MessageRecommendedValue + ", Severity=" + $Finding.Severity + } Else { + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", Result=$Result, Recommended=" + $MessageRecommendedValue + ", Severity=" + $Finding.Severity + } + + Write-ResultEntry -Text $Message -SeverityLevel $Finding.Severity + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $Finding.Severity + Result = $Result + Recommended = $MessageRecommendedValue + TestResult = $TestResult + SeverityFinding = $Finding.Severity + DefaultValue = $ResultDefaultValue + Filter = $Finding.Filter + } + $ReportAllResults += $ReportResult + } + + # Increment Counter + Switch ($Finding.Severity) { + + "Low" { $StatsLow++; Break } + "Medium" { $StatsMedium++; Break } + "High" { $StatsHigh++; Break } + } + } + + # + # Only return received value + # + } Elseif ($Mode -eq "Config") { + + $Message = "ID " + $Finding.ID + "; " + $Finding.Name + "; Result=$Result" + Write-ResultEntry -Text $Message + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = "" + Result = $Result + Recommended = "" + TestResult = "" + SeverityFinding = "" + DefaultValue = $ResultDefaultValue + Filter = $Finding.Filter + } + $ReportAllResults += $ReportResult + } + If ($Backup) { + + # Do not save Firewall rules in the backup file, if they are not set + If ( $Finding.Method -eq "FirewallRule" -and !$Result ) { + Continue + } + + $BackupResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Method = $Finding.Method + MethodArgument = $Finding.MethodArgument + RegistryPath = $Finding.RegistryPath + RegistryItem = $Finding.RegistryItem + ClassName =$Finding.ClassName + Namespace = $Finding.Namespace + Property = $Finding.Property + DefaultValue = $Finding.DefaultValue + RecommendedValue = $Result + Operator = $Finding.Operator + Severity = $Finding.Severity + } + $BackupAllResults += $BackupResult + } + } + } + } + + # + # Start HailMary mode + # HardeningKitty configures all settings in a finding list file. + # Even though HardeningKitty works very carefully, please only + # use HailyMary if you know what you are doing. + # + Elseif ($Mode -eq "HailMary") { + + # A CSV finding list is imported + If ($FileFindingList.Length -eq 0) { + + # No fallback to a default list anymore, just show an error message + # $CurrentLocation = $PSScriptRoot + # $DefaultList = "$CurrentLocation\lists\finding_list_0x6d69636b_machine.csv" + $Message = "No finding list has been specified - I'm sorry Dave, I'm afraid I can't do that. Please select a suitable list and specify it with the FileFindingList parameter. Select the finding list wisely and check beforehand whether the settings can affect the stability or the function of your system." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Continue + + If (Test-Path -Path $DefaultList) { + $FileFindingList = $DefaultList + } Else { + $Message = "The finding list $DefaultList was not found." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Continue + } + } + + $FindingList = Import-Csv -Path $FileFindingList -Delimiter "," + + # Verify the finding list against the signed official manifest before applying anything. + # HailMary is a write mode: refuse an unverified (custom / modified) list unless the operator + # explicitly accepts the risk with -AllowCustomList. + $ListStatus = Confirm-FindingListIntegrity -ListPath $FileFindingList ` + -ManifestPath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName") ` + -SignaturePath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName.p7s") ` + -PinnedThumbprint $HardeningKittyListSigningThumbprint + If ($ListStatus.Verified) { + Write-ProtocolEntry -Text "Finding list verified as official (signature valid). SHA-256: $($ListStatus.Hash)" -LogLevel "Success" + } ElseIf ($AllowCustomList) { + Write-ProtocolEntry -Text "Applying an UNVERIFIED finding list at your own risk ($($ListStatus.Reason)). SHA-256: $($ListStatus.Hash)" -LogLevel "Warning" + } Else { + Write-ProtocolEntry -Text "Refusing to apply an unverified finding list in $Mode mode ($($ListStatus.Reason)). SHA-256: $($ListStatus.Hash). Re-run with -AllowCustomList to apply it at your own risk." -LogLevel "Error" + Break + } + + If ($Filter) { + $FindingList = $FindingList | Where-Object -FilterScript $Filter + If ($FindingList.Length -eq 0) { + $Message = "Your filter did not return any results, please adjust the filter so that HardeningKitty has something to work with." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + + $LastCategory = "" + $ProcessmitigationEnableArray = @() + $ProcessmitigationDisableArray = @() + + # + # Stop before changing anything if admin rights are missing + # Without admin rights these findings would be skipped one by one, leaving the system + # partially hardened (issue #206). HKCU registry findings, e.g. a user list applied by + # the user themselves, work without admin rights. + # + If (-not($IsAdmin)) { + $AdminMethods = @('secedit', 'auditpol', 'accountpolicy', 'accesschk', 'WindowsOptionalFeature', 'MpPreference', 'MpPreferenceAsr', 'Processmitigation', 'bcdedit', 'FirewallRule', 'ScheduledTask') + $AdminFindings = @($FindingList | Where-Object { + ($AdminMethods -contains $_.Method) -or + (($_.Method -eq 'Registry' -or $_.Method -eq 'RegistryList') -and -not($_.RegistryPath.StartsWith("HKCU:\"))) + }) + If ($AdminFindings.Count -gt 0) { + $Message = "HailMary requires admin privileges for $($AdminFindings.Count) finding(s) in this list. Nothing has been changed. Please run HardeningKitty as administrator." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + If ($HardeningKittyTempDir -and (Test-Path -LiteralPath $HardeningKittyTempDir)) { + Remove-Item -LiteralPath $HardeningKittyTempDir -Recurse -Force -ErrorAction SilentlyContinue + } + Return + } + } + + # + # Create a System Restore Point + # + + If (-not($SkipRestorePoint)) { + + $Message = "Creating a system restore point" + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID "42" -FindingName "System Restore Point" -FindingMethod "Checkpoint-Computer" + Continue + } + + If ($PSVersionTable.PSVersion.Major -gt 5) { + $Message = "The cmdlet used to create a system restore has been removed from PowerShell in version 6 onwards. To create a system restore, run HardeninKitty with PowerShell version 5. Alternatively, create a system restore point manually and use the -SkipRestorePoint parameter to run HailMary anyway. Be careful!" + Write-ResultEntry -Text $Message -SeverityLevel "High" + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + Break + } + + Try { + Enable-ComputerRestore -Drive $Env:SystemDrive + Checkpoint-Computer -Description 'HardeningKitty' -RestorePointType 'MODIFY_SETTINGS' -ErrorAction Stop -WarningAction Stop + } catch { + + $Message = "Creating a system restore point failed. Use -SkipRestorePoint to run HailMary anyway. Be careful!" + Write-ResultEntry -Text $Message -SeverityLevel "High" + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + Break + } + + $Message = "Creating a system restore point was successful" + Write-ResultEntry -Text $Message -SeverityLevel "Passed" + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + } + + ForEach ($Finding in $FindingList) { + + # + # Category + # + If ($LastCategory -ne $Finding.Category) { + + $Message = "Starting Category " + $Finding.Category + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + $LastCategory = $Finding.Category + } + + # + # Registry + # Create or modify a registry value. + # + If ($Finding.Method -eq 'Registry' -or $Finding.Method -eq 'RegistryList') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin) -and -not($Finding.RegistryPath.StartsWith("HKCU:\"))) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # + # Do not set/configure certain registry + # ASR rules configured with Intune (ASRRules, ASROnlyExclusions) + # Defender expections configured with Intune (ExcludedExtensions, ExcludedPaths, ExcludedProcesses) + # + If ($Finding.RegistryItem -eq "ASRRules" -Or $Finding.RegistryItem -eq "ASROnlyExclusions" -Or $Finding.RegistryItem -eq "ExcludedExtensions" -Or $Finding.RegistryItem -eq "ExcludedPaths" -Or $Finding.RegistryItem -eq "ExcludedProcesses") { + $ResultText = "This setting is not configured by HardeningKitty" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + $RegType = "String" + + # + # Basically this is true, but there is an exception for the finding "MitigationOptions_FontBocking", + # the value "10000000000" is written to the registry as a string... + # + # ... and more exceptions are added over time: + # + # MitigationOptions_FontBocking => Mitigation Options: Untrusted Font Blocking + # Machine => Network access: Remotely accessible registry paths + # Retention => Event Log Service: *: Control Event Log behavior when the log file reaches its maximum size + # AllocateDASD => Devices: Allowed to format and eject removable media + # ScRemoveOption => Interactive logon: Smart card removal behavior + # AutoAdminLogon => MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) + # + If ($Finding.RegistryItem -eq "MitigationOptions_FontBocking" -Or $Finding.RegistryItem -eq "Retention" -Or $Finding.RegistryItem -eq "AllocateDASD" -Or $Finding.RegistryItem -eq "ScRemoveOption" -Or $Finding.RegistryItem -eq "AutoAdminLogon") { + $RegType = "String" + } ElseIf ($Finding.RegistryItem -eq "Machine" -Or $Finding.RegistryItem -eq "EccCurves" -Or $Finding.RegistryItem -eq "NullSessionPipes" -Or $Finding.RegistryItem -eq "NullSessionShares") { + $RegType = "MultiString" + $Finding.RecommendedValue = $Finding.RecommendedValue -split ";" + } ElseIf ($Finding.RecommendedValue -match "^\d+$") { + $RegType = "DWord" + } + + If (!(Test-Path $Finding.RegistryPath)) { + + $Result = New-Item $Finding.RegistryPath -Force; + + If ($Result) { + $ResultText = "Registry key created" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } Else { + $ResultText = "Failed to create registry key" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + } + + # + # The method RegistryList needs a separate handling, because the name of the registry key is dynamic, usually incremented. + # Therefore, it is searched whether the value already exists or not. If the value does not exist, it counts how many + # other values are already there in order to set the next higher value and not overwrite existing keys. + # + If ($Finding.Method -eq 'RegistryList') { + $RegistryItemFound = $false + $ListPolicies = $Finding.RegistryPath + $ResultList = Get-ItemProperty -Path $Finding.RegistryPath + $ResultListCounter = 0 + If ($ResultList | Where-Object { $_ -like "*" + $Finding.RegistryItem + "*" }) { + $ResultList.PSObject.Properties | ForEach-Object { + If ($_.Value -eq $Finding.RegistryItem) { + $Finding.RegistryItem = $_.Name + $RegistryItemFound = $true + } + } + } Else { + $ResultList.PSObject.Properties | ForEach-Object { + $ResultListCounter++ + } + } + # Check if registryItem (key name) has been found or not + If ($RegistryItemFound -eq $false) { + If ($ResultListCounter -eq 0) { + $Finding.RegistryItem = 1 + } Else { + # Check if key is already used and can be used + $KeyAlreadyExists = $true + $Finding.RegistryItem = 1 + while ($KeyAlreadyExists){ + try { + # This key exists and should be incremented + $Result = Get-ItemPropertyValue -Path $Finding.RegistryPath -Name $Finding.RegistryItem + $Finding.RegistryItem=$Finding.RegistryItem+1 + $KeyAlreadyExists = $true; + } catch { + # This key does not exist and it can be used + $KeyAlreadyExists = $false; + } + } + } + } + } + $ResultText = "" + # Remove this policy if it should not exists + If ($Finding.RecommendedValue -eq '-NODATA-') { + + # Check if the key (item) already exists + $keyExists = $true; + try { + # This key exists + $Result = Get-ItemPropertyValue -Path $Finding.RegistryPath -Name $Finding.RegistryItem + } catch { + # This key does not exist + $keyExists = $false; + } + + If ($keyExists) { + # key exists + try { + Remove-ItemProperty -Path $Finding.RegistryPath -Name $Finding.RegistryItem + $ResultText = "Registry key removed" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } catch { + $ResultText = "Failed to remove registry key" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + } Else { + # key does not exists + + If ($Finding.Method -eq 'RegistryList') { + # Don't show incorrect item + $ResultText = "This value does not already exists in list policy" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $ResultText + } Else { + $ResultText = "This key policy does not already exists" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + } + $MessageSeverity = "Low" + $TestResult = "Passed" + } + + + } Else { + $Result = Set-ItemProperty -PassThru -Path $Finding.RegistryPath -Name $Finding.RegistryItem -Type $RegType -Value $Finding.RecommendedValue + + if ($Result) { + $ResultText = "Registry value created/modified" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } else { + $ResultText = "Failed to create registry value" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # secedit + # Set a security policy + # + If ($Finding.Method -eq 'secedit') { + + # Check if Secedit binary is available, skip test if not + If (-Not (Test-Path $BinarySecedit)) { + Write-BinaryError -Binary $BinarySecedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $Area = ""; + + Switch ($Finding.Category) { + "Account Policies" { $Area = "SECURITYPOLICY"; Break } + "Security Options" { $Area = "SECURITYPOLICY"; Break } + } + + # MethodArgument comes from the finding list and is written into the security + # policy that is applied with secedit /configure /overwrite. Reject control + # characters (CR/LF) so a finding list entry cannot inject additional INI lines. + If ($Finding.MethodArgument -match "[\r\n]") { + $ResultText = "Invalid MethodArgument, contains control characters" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + $TempFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -CreateFile + # secedit.exe must create the database itself: a pre-created empty file fails with + # "Error 9: The storage control block address is invalid" (issue #214) + $TempDbFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -Extension ".sdb" + + &$BinarySecedit /export /cfg $TempFileName /areas $Area | Out-Null + + $Data = Get-IniContent $TempFileName + + Set-HashtableValueDeep -Table $Data -Path $Finding.MethodArgument -Value $Finding.RecommendedValue + + Out-IniFile -InputObject $Data -FilePath $TempFileName -Encoding Unicode + + &$BinarySecedit /configure /cfg $TempFileName /overwrite /areas $Area /db $TempDbFileName /quiet | Out-Null + + if ($LastExitCode -ne 0) { + $ResultText = "Failed to configure security policy" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Remove-Item $TempFileName + Remove-Item $TempDbFileName -ErrorAction SilentlyContinue + Continue + } + + $ResultText = "Configured security policy" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + + Remove-Item $TempFileName + Remove-Item $TempDbFileName -ErrorAction SilentlyContinue + } + + # + # auditpol + # Set an audit policy + # + If ($Finding.Method -eq 'auditpol') { + + # Check if Auditpol binary is available, skip test if not + If (-Not (Test-Path $BinaryAuditpol)) { + Write-BinaryError -Binary $BinaryAuditpol -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $Success = if ($Finding.RecommendedValue -ilike "*success*") { "enable" } else { "disable" } + $Failure = if ($Finding.RecommendedValue -ilike "*failure*") { "enable" } else { "disable" } + + $SubCategory = $Finding.MethodArgument + + &$BinaryAuditpol /set /subcategory:"$($SubCategory)" /success:$($Success) /failure:$($Failure) | Out-Null + + if ($LastExitCode -eq 0) { + $ResultText = "Audit policy set" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } else { + $ResultText = "Failed to set audit policy" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # accountpolicy + # Set a user account policy + # + If ($Finding.Method -eq 'accountpolicy') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if net binary is available, skip test if not + If (-Not (Test-Path $BinaryNet)) { + Write-BinaryError -Binary $BinaryNet -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $Sw = ""; + + Switch ($Finding.Name) { + "Force user logoff how long after time expires" { $Sw = "/FORCELOGOFF:$($Finding.RecommendedValue)"; Break } + "Minimum password age" { $Sw = "/MINPWAGE:$($Finding.RecommendedValue)"; Break } + "Maximum password age" { $Sw = "/MAXPWAGE:$($Finding.RecommendedValue)"; Break } + "Minimum password length" { $Sw = "/MINPWLEN:$($Finding.RecommendedValue)"; Break } + "Length of password history maintained" { $Sw = "/UNIQUEPW:$($Finding.RecommendedValue)"; Break } + "Account lockout threshold" { $Sw = "/lockoutthreshold:$($Finding.RecommendedValue)"; Break; } + "Account lockout duration" { $Sw = @("/lockoutwindow:$($Finding.RecommendedValue)", "/lockoutduration:$($Finding.RecommendedValue)"); Break } + "Reset account lockout counter" { $Sw = "/lockoutwindow:$($Finding.RecommendedValue)"; Break } + } + + &$BinaryNet accounts $Sw | Out-Null + + if ($LastExitCode -eq 0) { + $ResultText = "Account policy set" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } else { + $ResultText = "Failed to set account policy" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # accesschk + # For the audit mode, accesschk is used, but the rights are set with secedit. + # + If ($Finding.Method -eq 'accesschk') { + + # Check if Secedit binary is available, skip test if not + If (-Not (Test-Path $BinarySecedit)) { + Write-BinaryError -Binary $BinarySecedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $Area = "USER_RIGHTS"; + + # MethodArgument comes from the finding list and is written into the security + # policy that is applied with secedit /configure /overwrite. Reject control + # characters (CR/LF) so a finding list entry cannot inject additional INI lines. + If ($Finding.MethodArgument -match "[\r\n]") { + $ResultText = "Invalid MethodArgument, contains control characters" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + $TempFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -CreateFile + # secedit.exe must create the database itself: a pre-created empty file fails with + # "Error 9: The storage control block address is invalid" (issue #214) + $TempDbFileName = New-HardeningKittyTempFile -Directory $HardeningKittyTempDir -Extension ".sdb" + + &$BinarySecedit /export /cfg $TempFileName /areas $Area | Out-Null + + # MethodArgument is used to locate and rewrite the matching line. Escape it so it is + # treated as literal text and cannot inject regular-expression metacharacters. The + # replacement text is likewise escaped so a literal "$" is not interpreted as a + # regex substitution token ($1, $&, ...). + $MethodArgumentPattern = [regex]::Escape($Finding.MethodArgument) + ".*" + + if ($Finding.RecommendedValue -eq "") { + $Replacement = ($Finding.MethodArgument + " = ").Replace('$', '$$') + (Get-Content -Encoding unicode $TempFileName) -replace $MethodArgumentPattern, $Replacement | Out-File $TempFileName + } else { + $ListTranslated = @() + $Finding.RecommendedValue -split ';' | Where-Object { + # Get SID to translate the account name + $AccountSid = Translate-SidFromWellkownAccount -AccountName $_ + # Get account name from system with SID (local translation) + $AccountName = Get-AccountFromSid -AccountSid $AccountSid + $ListTranslated += $AccountName + } + + # If User Right Assignment exists, replace values + If ( ((Get-Content -Encoding unicode $TempFileName) | Select-String -SimpleMatch $Finding.MethodArgument).Count -gt 0 ) { + $Replacement = ($Finding.MethodArgument + " = " + ($ListTranslated -join ',')).Replace('$', '$$') + (Get-Content -Encoding unicode $TempFileName) -replace $MethodArgumentPattern, $Replacement | Out-File $TempFileName + } + # If it does not exist, add a new entry into the file at the right position + Else { + $TempFileContent = Get-Content -Encoding unicode $TempFileName + $LineNumber = $TempFileContent.Count + $TempFileContent[$LineNumber - 3] = "$($Finding.MethodArgument) = $($ListTranslated -join ',')" + $TempFileContent[$LineNumber - 2] = "[Version]" + $TempFileContent[$LineNumber - 1] = 'signature="$CHICAGO$"' + $TempFileContent += "Revision=1" + $TempFileContent | Set-Content -Encoding unicode $TempFileName + } + } + + &$BinarySecedit /configure /cfg $TempFileName /overwrite /areas $Area /db $TempDbFileName /quiet | Out-Null + + if ($LastExitCode -ne 0) { + $ResultText = "Failed to configure system user right assignment" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Remove-Item $TempFileName + Remove-Item $TempDbFileName -ErrorAction SilentlyContinue + Continue + } + + $ResultText = "Configured system user right assignment" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $Finding.RecommendedValue + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + + Remove-Item $TempFileName + Remove-Item $TempDbFileName -ErrorAction SilentlyContinue + } + + # + # WindowsOptionalFeature + # Install / Remove a Windows feature + # + If ($Finding.Method -eq 'WindowsOptionalFeature') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # + # Check if feature is installed and should be removed, or + # it is missing and should be installed + # + try { + $ResultOutput = Get-WindowsOptionalFeature -Online -FeatureName $Finding.MethodArgument + $Result = $ResultOutput.State + } catch { + $ResultText = "Could not check status" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + # Feature will be removed, a reboot will be suppressed + If ($Result -eq "Enabled" -and $Finding.RecommendedValue -eq "Disabled") { + + try { + $Result = Disable-WindowsOptionalFeature -NoRestart -Online -FeatureName $Finding.MethodArgument + } catch { + $ResultText = "Could not be removed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + $ResultText = "Feature removed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + } + # No changes required + ElseIf ($Result -eq "Disabled" -and $Finding.RecommendedValue -eq "Disabled") { + $ResultText = "Feature is not installed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + } + # Feature will be installed, a reboot will be suppressed + ElseIf ($Result -eq "Disabled" -and $Finding.RecommendedValue -eq "Enabled") { + + try { + $Result = Enable-WindowsOptionalFeature -NoRestart -Online -FeatureName $Finding.MethodArgument + } catch { + $ResultText = "Could not be installed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + Continue + } + + $ResultText = "Feature installed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } + # No changes required + ElseIf ($Result -eq "Enabled" -and $Finding.RecommendedValue -eq "Enabled") { + $ResultText = "Feature is already installed" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # MpPreference + # Set a Windows Defender policy + # + If ($Finding.Method -eq 'MpPreference') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $ResultMethodArgument = $Finding.MethodArgument + $ResultRecommendedValue = $Finding.RecommendedValue + + Switch ($ResultRecommendedValue) { + "True" { $ResultRecommendedValue = 1; Break } + "False" { $ResultRecommendedValue = 0; Break } + } + + # Build a hashtable MpPreferenceArgs for splatting arguments to Set-MpPreference. See https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_splatting + $MpPreferenceArgs = @{ + $ResultMethodArgument = $ResultRecommendedValue + } + + Set-MpPreference @MpPreferenceArgs + + if ($?) { + $ResultText = "Method value modified" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } else { + $ResultText = "Failed to change Method value" + $Message = "ID " + $Finding.ID + ", " + $Finding.MethodArgument + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Passed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # Microsoft Defender Preferences - Attack surface reduction rules (ASR rules) + # The values are saved from a PowerShell function into an object. + # The desired arguments can be accessed directly. + # + If ($Finding.Method -eq 'MpPreferenceAsr') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $ResultMethodArgument = $Finding.MethodArgument + $ResultRecommendedValue = $Finding.RecommendedValue + + Switch ($ResultRecommendedValue) { + "True" { $ResultRecommendedValue = 1; Break } + "False" { $ResultRecommendedValue = 0; Break } + } + + # Build a hashtable MpPreferenceArgs for splatting arguments to Set-MpPreference. See https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_splatting + $MpPreferenceArgs = @{ + AttackSurfaceReductionRules_Ids = $ResultMethodArgument + AttackSurfaceReductionRules_Actions = $ResultRecommendedValue + } + + Add-MpPreference @MpPreferenceArgs + + if ($?) { + $ResultText = "ASR rule added to list" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.MethodArgument + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } else { + $ResultText = "Failed to add ASR rule" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $Finding.MethodArgument + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # Exploit protection + # Set exploit protection values + # + # I noticed irregularities when the process mitigations were set individually, + # in some cases settings that had already been set were then reset. Therefore, + # the settings are collected in an array and finally set at the end of the processing. + # + If ($Finding.Method -eq 'Processmitigation') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $SettingArgumentArray = $Finding.MethodArgument.Split(".") + + If ( $Finding.RecommendedValue -eq "ON") { + + If ( $SettingArgumentArray[1] -eq "Enable" ) { + $ProcessmitigationEnableArray += $SettingArgumentArray[0] + } Else { + $ProcessmitigationEnableArray += $SettingArgumentArray[1] + } + } ElseIf ( $Finding.RecommendedValue -eq "OFF") { + + If ($SettingArgumentArray[1] -eq "TelemetryOnly") { + $ProcessmitigationDisableArray += "SEHOPTelemetry" + } ElseIf ( $SettingArgumentArray[1] -eq "Enable" ) { + $ProcessmitigationDisableArray += $SettingArgumentArray[0] + } Else { + $ProcessmitigationDisableArray += $SettingArgumentArray[1] + } + } + $ResultText = "setting added to list" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # bcdedit + # Force use of Data Execution Prevention, if it is not already set + # + If ($Finding.Method -eq 'bcdedit') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check if Bcdedit binary is available, skip test if not + If (-Not (Test-Path $BinaryBcdedit)) { + Write-BinaryError -Binary $BinaryBcdedit -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + try { + + $ResultOutput = &$BinaryBcdedit + $ResultOutput = $ResultOutput | Where-Object { $_ -like "*" + $Finding.RecommendedValue + "*" } + + If ($ResultOutput -match ' ([a-z,A-Z]+)') { + $Result = $Matches[1] + } Else { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + If ($Result -ne $Finding.RecommendedValue) { + + try { + $ResultOutput = &$BinaryBcdedit "/set" $Finding.MethodArgument $Finding.RecommendedValue + $ResultExitCode = $LASTEXITCODE + } catch { + $ResultExitCode = 1 + } + + If ($ResultExitCode -eq 0) { + $ResultText = "Setting enabled. Please restart the system to activate it" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } Else { + $ResultText = "Setting could not be enabled" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + } Else { + $ResultText = "Setting is already set correct" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # FirewallRule + # Create a firewall rule. First it will be checked if the rule already exists + # + If ($Finding.Method -eq 'FirewallRule') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + $FwState = $Finding.RecommendedValue + If ($FwState -eq 'False') { + # Do not create a firewall rule with state equal to false + Continue + } + + $FwRule = $Finding.MethodArgument + $FwRuleArray = $FwRule.Split("|") + + $FwDisplayName = $Finding.Name + $FwProfile = $FwRuleArray[0] + $FwDirection = $FwRuleArray[1] + $FwAction = $FwRuleArray[2] + $FwProtocol = $FwRuleArray[3] + $FwLocalPort = @($FwRuleArray[4]).Split(",") + $FwProgram = $FwRuleArray[5] + + # Check if rule already exists + try { + + $ResultOutput = Get-NetFirewallRule -PolicyStore ActiveStore -DisplayName $FwDisplayName 2> $null + $Result = $ResultOutput.Enabled + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + # Go on if rule not exists + If (-Not $Result) { + + If ($FwProgram -eq "") { + $ResultRule = New-NetFirewallRule -DisplayName $FwDisplayName -Profile $FwProfile -Direction $FwDirection -Action $FwAction -Protocol $FwProtocol -LocalPort $FwLocalPort + } Else { + $ResultRule = New-NetFirewallRule -DisplayName $FwDisplayName -Profile $FwProfile -Direction $FwDirection -Action $FwAction -Program "$FwProgram" + } + + If ($ResultRule.PrimaryStatus -eq "OK") { + + # Excellent + $ResultText = "Rule created" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } Else { + # Bogus + $ResultText = "Rule not created" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + } + } Else { + # Excellent + $ResultText = "Rule already exists, setting Recommended Value" + Set-NetFirewallRule -DisplayName $FwDisplayName -Enabled $Finding.RecommendedValue + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + + # + # Scheduled Task + # Edit a scheduled task. First it will be checked if a modification is required + # + If ($Finding.Method -eq 'ScheduledTask') { + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID $Finding.ID -FindingName $Finding.Name -FindingMethod $Finding.Method + Continue + } + + # Check the state of the scheduled task + try { + $ResultOutput = Get-ScheduledTask -TaskName $Finding.MethodArgument 2> $null + $Result = $ResultOutput.State + + } catch { + $Result = $Finding.DefaultValue + $ResultDefaultValue = $true + } + + # Check if a modification is requried + If ($Result -eq $Finding.RecommendedValue) { + + # Excellent + $ResultText = "Scheduled Task has alredy the recommended state" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + + } Else { + + If ($Finding.RecommendedValue -eq "Disabled") { + + $Result = Get-ScheduledTask -TaskName $Finding.MethodArgument | Disable-ScheduledTask + + $ResultText = "Scheduled Task was disabled" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + + } ElseIf ($Finding.RecommendedValue -eq "Ready") { + + $Result = Get-ScheduledTask -TaskName $Finding.MethodArgument | Enable-ScheduledTask + + $ResultText = "Scheduled Task was enabled" + $Message = "ID " + $Finding.ID + ", " + $Finding.Name + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } + } + + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + } + + # + # After all items of the checklist have been run through, the process mitigation settings can now be set... + # + If ( $ProcessmitigationEnableArray.Count -gt 0 -and $ProcessmitigationDisableArray.Count -gt 0) { + + $ResultText = "Process mitigation settings set" + $MessageSeverity = "Passed" + $TestResult = "Passed" + + try { + $Result = Set-ProcessMitigation -System -Enable $ProcessmitigationEnableArray -Disable $ProcessmitigationDisableArray + } catch { + $ResultText = "Failed to set process mitigation settings" + $MessageSeverity = "High" + $TestResult = "Failed" + } + + $Message = "Starting Category Microsoft Defender Exploit Guard" + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + + $Message = $ResultText + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } ElseIf ($ProcessmitigationEnableArray.Count -gt 0 -and $ProcessmitigationDisableArray.Count -eq 0) { + $ResultText = "Process mitigation settings set" + $MessageSeverity = "Passed" + $TestResult = "Passed" + + try { + $Result = Set-ProcessMitigation -System -Enable $ProcessmitigationEnableArray + } catch { + $ResultText = "Failed to set process mitigation settings" + $MessageSeverity = "High" + $TestResult = "Failed" + } + + $Message = "Starting Category Microsoft Defender Exploit Guard" + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + + $Message = $ResultText + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } ElseIf ($ProcessmitigationEnableArray.Count -eq 0 -and $ProcessmitigationDisableArray.Count -gt 0) { + $ResultText = "Process mitigation settings set" + $MessageSeverity = "Passed" + $TestResult = "Passed" + + try { + $Result = Set-ProcessMitigation -System -Disable $ProcessmitigationDisableArray + } catch { + $ResultText = "Failed to set process mitigation settings" + $MessageSeverity = "High" + $TestResult = "Failed" + } + + $Message = "Starting Category Microsoft Defender Exploit Guard" + Write-Output "`n" + Write-ProtocolEntry -Text $Message -LogLevel "Info" + + $Message = $ResultText + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + If ($Report) { + $ReportResult = [ordered] @{ + ID = $Finding.ID + Category = $Finding.Category + Name = $Finding.Name + Severity = $MessageSeverity + Result = $ResultText + Recommended = "" + TestResult = $TestResult + SeverityFinding = "" + } + $ReportAllResults += $ReportResult + } + } + } + + + # + # Start GPO mode + # HardeningKitty configures all settings in a finding list file. + # Even though HardeningKitty works very carefully. + # The GPO mode create a GPO containing every registry method remediation. + # + Elseif ($Mode -eq "GPO") { + + Write-Output "`n" + If ($GPOname.Length -eq 0) { + # Control if a GPO name is given + $Message = "The GPO Name $GPOname was not found." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + If ($FileFindingList.Length -eq 0) { + # Control if a Finding list is given + $CurrentLocation = $PSScriptRoot + $DefaultList = "$CurrentLocation\lists\finding_list_0x6d69636b_machine.csv" + + If (Test-Path -Path $DefaultList) { + $FileFindingList = $DefaultList + } Else { + $Message = "The finding list $DefaultList was not found." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + + # Check if the user has admin rights, skip test if not + If (-not($IsAdmin)) { + Write-NotAdminError -FindingID "0" -FindingName "GPO Mode" -FindingMethod "Create a GPO" + Continue + } + + # Check if the New-GPO cmdlet is available + try { + $CheckRsatStatus = Get-Command New-GPO -ErrorAction Stop + } catch { + Write-BinaryError -Binary "Group Policy Management PowerShell Module" -FindingID "0" -FindingName "GPO Mode" -FindingMethod "Create a GPO" + Continue + } + + # Should check if user is domain admin + try { + New-GPO -Name $GPOname -ErrorAction Stop | Out-Null + } + catch [System.ArgumentException] { + # Control if the Name of the GPO is ok + Write-ProtocolEntry -Text $_.Exception.Message -LogLevel "Error" + Break + } + + # Iterrate over finding list + $FindingList = Import-Csv -Path $FileFindingList -Delimiter "," + + # Verify the finding list against the signed official manifest before creating the GPO. + # GPO is a write mode: refuse an unverified (custom / modified) list unless the operator + # explicitly accepts the risk with -AllowCustomList. This runs before New-GPO so a refused + # run does not leave an empty GPO behind. + $ListStatus = Confirm-FindingListIntegrity -ListPath $FileFindingList ` + -ManifestPath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName") ` + -SignaturePath (Join-Path -Path $PSScriptRoot -ChildPath "lists\$HardeningKittyListManifestName.p7s") ` + -PinnedThumbprint $HardeningKittyListSigningThumbprint + If ($ListStatus.Verified) { + Write-ProtocolEntry -Text "Finding list verified as official (signature valid). SHA-256: $($ListStatus.Hash)" -LogLevel "Success" + } ElseIf ($AllowCustomList) { + Write-ProtocolEntry -Text "Applying an UNVERIFIED finding list at your own risk ($($ListStatus.Reason)). SHA-256: $($ListStatus.Hash)" -LogLevel "Warning" + } Else { + Write-ProtocolEntry -Text "Refusing to apply an unverified finding list in $Mode mode ($($ListStatus.Reason)). SHA-256: $($ListStatus.Hash). Re-run with -AllowCustomList to apply it at your own risk." -LogLevel "Error" + Break + } + + If ($Filter) { + $FindingList = $FindingList | Where-Object -FilterScript $Filter + If ($FindingList.Length -eq 0) { + $Message = "Your filter did not return any results, please adjust the filter so that HardeningKitty has something to work with." + Write-ProtocolEntry -Text $Message -LogLevel "Error" + Break + } + } + + ForEach ($Finding in $FindingList) { + # + # Only Registry Method Policies + # + If ($Finding.Method -eq "Registry") { + $RegType = "String" + + # + # Basically this is true, but there is an exception for the finding "MitigationOptions_FontBocking", + # the value "10000000000" is written to the registry as a string... + # + # ... and more exceptions are added over time: + # + # MitigationOptions_FontBocking => Mitigation Options: Untrusted Font Blocking + # Machine => Network access: Remotely accessible registry paths + # Retention => Event Log Service: *: Control Event Log behavior when the log file reaches its maximum size + # AllocateDASD => Devices: Allowed to format and eject removable media + # ScRemoveOption => Interactive logon: Smart card removal behavior + # AutoAdminLogon => MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) + # + If ($Finding.RegistryItem -eq "MitigationOptions_FontBocking" -Or $Finding.RegistryItem -eq "Retention" -Or $Finding.RegistryItem -eq "AllocateDASD" -Or $Finding.RegistryItem -eq "ScRemoveOption" -Or $Finding.RegistryItem -eq "AutoAdminLogon") { + $RegType = "String" + } ElseIf ($Finding.RegistryItem -eq "Machine") { + $RegType = "MultiString" + $Finding.RecommendedValue = $Finding.RecommendedValue -split ";" + } ElseIf ($Finding.RecommendedValue -match "^\d+$") { + $RegType = "DWord" + $Finding.RecommendedValue = ConvertToInt -string $Finding.RecommendedValue + } + $RegPath = $Finding.RegistryPath.Replace(":","") + $RegItem = $Finding.RegistryItem + + try { + Set-GPRegistryValue -Name $GPOname -Key $RegPath -ValueName $RegItem -Type $RegType -Value $Finding.RecommendedValue | Out-Null + $ResultText = "Registry value added successfully" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $Finding.RegistryItem + ", " + $ResultText + $MessageSeverity = "Passed" + $TestResult = "Passed" + } catch { + $ResultText = "Failed to add registry key" + $Message = "ID " + $Finding.ID + ", " + $Finding.RegistryPath + ", " + $ResultText + $MessageSeverity = "High" + $TestResult = "Failed" + + } finally { + Write-ResultEntry -Text $Message -SeverityLevel $MessageSeverity + If ($Log) { + Add-MessageToFile -Text $Message -File $LogFile + } + } + } + } + } + + # Write report file + If ($Report) { + Write-Output "`n" + Write-ProtocolEntry -Text "HardeningKitty prepares the report" -LogLevel "Info" + ForEach ($ReportResult in $ReportAllResults) { + $ResultObject = [pscustomobject] $ReportResult + $ResultObject | Export-Csv -Path $ReportFile -Delimiter "," -NoTypeInformation -Append + } + Write-ProtocolEntry -Text "Report done" -LogLevel "Info" + } + + # Write backup file + If ($Backup) { + Write-Output "`n" + Write-ProtocolEntry -Text "HardeningKitty prepares the backup file" -LogLevel "Info" + ForEach ($BackupResult in $BackupAllResults) { + $BackupObject = [pscustomobject] $BackupResult + $BackupObject | Export-Csv -Path $BackupFile -Delimiter "," -NoTypeInformation -Append + } + Write-ProtocolEntry -Text "Backup file done" -LogLevel "Info" + } + + If ($Mode -eq "Audit") { + + # HardeningKitty Score + $StatsTotal = $StatsPassed + $StatsLow + $StatsMedium + $StatsHigh + $ScoreTotal = $StatsTotal * 4 + $ScoreAchived = $StatsPassed * 4 + $StatsLow * 2 + $StatsMedium + If ($ScoreTotal -ne 0 ) { + $HardeningKittyScore = ([int] $ScoreAchived / [int] $ScoreTotal) * 5 + 1 + } + $HardeningKittyScoreRounded = [math]::round($HardeningKittyScore, 2) + + # Overwrite HardeningKitty Score if no finding is passed + If ($StatsPassed -eq 0 ) { + $HardeningKittyScoreRounded = 1.00 + } + If ($Script:StatsError -gt 0) { + Write-ProtocolEntry -Text "During the execution of HardeningKitty errors occurred due to missing admin rights or tools. For a complete result, these errors should be resolved. Total errors: $Script:StatsError" -LogLevel "Error" + } + Write-Output "`n" + Write-ProtocolEntry -Text "Your HardeningKitty score is: $HardeningKittyScoreRounded. HardeningKitty Statistics: Total checks: $StatsTotal - Passed: $StatsPassed, Low: $StatsLow, Medium: $StatsMedium, High: $StatsHigh." -LogLevel "Info" + } + + # Remove the private working directory and any remaining temporary files + If ($HardeningKittyTempDir -and (Test-Path -LiteralPath $HardeningKittyTempDir)) { + Remove-Item -LiteralPath $HardeningKittyTempDir -Recurse -Force -ErrorAction SilentlyContinue + } + + Write-ProtocolEntry -Text "HardeningKitty is done" -LogLevel "Info" +} + +Export-ModuleMember -Function Invoke-HardeningKitty diff --git a/vendor/LICENSE b/vendor/LICENSE new file mode 100644 index 0000000..65a9508 --- /dev/null +++ b/vendor/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2017 Michael Schneider + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/vendor/lists/finding_list_0x6d69636b_machine.csv b/vendor/lists/finding_list_0x6d69636b_machine.csv new file mode 100644 index 0000000..9d50d71 --- /dev/null +++ b/vendor/lists/finding_list_0x6d69636b_machine.csv @@ -0,0 +1,419 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1000,Features,"SMBv1 Support",WindowsOptionalFeature,smb1protocol,,,,,,,,,Disabled,,Disabled,,contains,,High, +1103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1101,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1100,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +1104,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1102,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1200,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,BUILTIN\Administrators,,=,,Medium, +1201,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +1202,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,,,=,,Medium, +1203,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,contains,,Medium, +1204,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,contains,,Medium, +1205,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,contains,,Medium, +1206,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,contains,,Medium, +1300,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +1301,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +1328,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +1302,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +1303,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +1304,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low, +1305,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +1306,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +1329,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +1307,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +1308,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +1309,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +1310,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +1311,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +1324,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +1325,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +1312,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +1326,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +1313,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +1330,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,,=,,Medium, +1314,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +1315,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +1316,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +1317,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +1318,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +1319,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +1320,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +1321,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +1322,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +1323,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,1,,<=,,Medium, +1400,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +1418,"Windows Firewall","EnableFirewall (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium, +1401,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +1419,"Windows Firewall","Inbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium, +1402,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +1420,"Windows Firewall","Outbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium, +1403,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +1421,"Windows Firewall","Log size limit (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium, +1404,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +1422,"Windows Firewall","Log dropped packets (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium, +1405,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +1423,"Windows Firewall","Log successful connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low, +1406,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +1424,"Windows Firewall","EnableFirewall (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium, +1407,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +1425,"Windows Firewall","Inbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium, +1408,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +1426,"Windows Firewall","Outbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium, +1409,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +1427,"Windows Firewall","Log size limit (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium, +1410,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +1428,"Windows Firewall","Log dropped packets (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium, +1411,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +1429,"Windows Firewall","Log successful connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low, +1412,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +1430,"Windows Firewall","EnableFirewall (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium, +1413,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +1431,"Windows Firewall","Inbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium, +1414,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +1432,"Windows Firewall","Outbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium, +1415,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +1433,"Windows Firewall","Log size limit (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium, +1416,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +1434,"Windows Firewall","Log dropped packets (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium, +1417,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +1435,"Windows Firewall","Log successful connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low, +1500,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1501,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +1502,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +1503,"Advanced Audit Policy Configuration","DPAPI Activity",auditpol,{0CCE922D-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1504,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +1505,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +1506,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +1507,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +1508,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +1509,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1510,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +1511,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +1512,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1513,"Advanced Audit Policy Configuration","Kernel Object",auditpol,{0CCE921F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1514,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1515,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1516,"Advanced Audit Policy Configuration",SAM,auditpol,{0CCE9220-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1517,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +1518,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +1519,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1520,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +1521,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +1522,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +1523,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +1524,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +1525,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +1828,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +1600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +1829,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +1830,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +1601,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +1831,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +1832,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +1833,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +1834,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +1835,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +1836,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium, +1837,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,>=,,Medium, +1838,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +1839,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +1840,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +1602,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +1841,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +1842,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,785,,=,,Medium, +1843,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium, +1604,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +2108,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low, +2109,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low, +2110,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low, +2111,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium, +2112,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low, +2113,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low, +2116,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0,,1,,=,,Low, +2114,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low, +2115,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low, +1844,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +1772,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +1845,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +1846,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +1847,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +1848,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +1849,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +1850,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium, +1851,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0,,1,,=,,Medium, +1852,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +1853,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +1768,"Administrative Templates: Printers","Only use Package Point and Print (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintOnly,,,,,,,,,1,,=,,Medium, +1769,"Administrative Templates: Printers","Package Point and Print - Approved servers (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintServerList,,,,,,,,,1,,=,,Medium, +1764,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,High, +1765,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,High, +1771,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +1854,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0,,1,,=,,Medium, +1855,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +1856,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +1605,"Administrative Templates: System","Credentials Delegation: Allow delegation default credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowDefaultCredentials,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowDefaultCredentials,,,,1,,0,,=,,Medium, +1606,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +1699,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +1614,"Administrative Templates: System","Device Guard: Virtualization Based Security Status",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,VirtualizationBasedSecurityStatus,"Not available",,2,,=,,Medium, +1615,"Administrative Templates: System","Device Guard: Available Security Properties: Secure Boot",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,2,,2,,=,,Medium, +1616,"Administrative Templates: System","Device Guard: Available Security Properties: DMA protection",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,3,,3,,=,,Medium, +1617,"Administrative Templates: System","Device Guard: Security Services Configured: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available",,1,,=,,Medium, +1619,"Administrative Templates: System","Device Guard: Security Services Running: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available",,1,,=,,Medium, +1618,"Administrative Templates: System","Device Guard: Security Services Configured: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available",,2,,=,,Medium, +1620,"Administrative Templates: System","Device Guard: Security Services Running: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available",,2,,=,,Medium, +1623,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +1621,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +1622,"Administrative Templates: System","Device Guard: Windows Defender Application Control deployed (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,DeployConfigCIPolicy,,,,,,,0,,1,,=,,Medium, +1607,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +1608,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +1609,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0010,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0010,,=,,Medium, +1610,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +1611,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +1612,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +1613,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +1630,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +1631,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +1632,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +1640,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +1641,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +1642,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +1643,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +1644,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +1645,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +1650,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +1857,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +1858,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,2,,=,,Medium, +1660,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +1661,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +1662,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +1670,"Administrative Templates: System","Mitigation Options: Untrusted Font Blocking",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions",MitigationOptions_FontBocking,,,,,,,0,,1000000000000,,=,,Medium, +1680,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +1859,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +1685,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +1686,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +1687,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +1688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +1690,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +1691,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +1692,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +1693,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,2,,=,,Medium, +1694,"Administrative Templates: System","Security Settings: Enable svchost.exe mitigation options",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig,EnableSvchostMitigationPolicy,,,,,,,0,,1,,=,,Medium, +1696,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +1697,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +1698,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +1860,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableAPISamping,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffAPISamping,,,,0,,1,,=,,Medium, +1861,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableApplicationFootprint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffApplicationFootprint,,,,0,,1,,=,,Medium, +1862,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInstallTracing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffInstallTracing,,,,0,,1,,=,,Medium, +1700,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +1701,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +1702,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +1703,"Administrative Templates: Windows Components","Application Compatibility: Turn off Application Telemetry",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AppCompat,AITEnable,,,,,,,1,,0,,=,,Medium, +1704,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +1705,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +1706,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +1707,"Administrative Templates: Windows Components","Biometrics: Allow the use of biometrics",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics,Enabled,,,,,,,1,,0,,=,,Medium, +1773,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +1708,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Volume status",BitLockerVolume,VolumeStatus,,,,,,,,,FullyDecrypted,,FullyEncrypted,,=,,High, +1761,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsOs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6,,6,,=,,Medium, +1762,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Drive encryption method (for operating system drives)",BitLockerVolume,EncryptionMethod,,,,,,,,,None,,XtsAes128,,=,,Medium, +1709,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +1710,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +1711,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +1715,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +1716,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +1717,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +1718,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +1719,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +1712,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +1713,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium, +1763,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,MinimumPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesMinimumPINLength,,,,,,8,,>=,,Medium, +1720,"Administrative Templates: Windows Components","Cloud Content: Do not show Windows tips",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableSoftLanding,,,,,,,0,,1,,=,,Medium, +1863,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +1721,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +1722,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +1724,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +1864,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +1725,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +1726,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowDeviceNameInTelemetry,,,,,,,1,,0,,=,,Medium, +1865,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +1866,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +1867,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +1868,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +1727,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,99,,=,,Medium, +1728,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +1729,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +1730,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +1774,"Administrative Templates: Windows Components","Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PowerShell/Operational,MaxSize,,,,,,,15728640,,268435456,,>=,,Medium, +1775,"Administrative Templates: Windows Components","Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB)",Registry,"",HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\PowerShellCore/Operational,MaxSize,,,,,,,15728640,,268435456,,>=,,Medium, +1731,"Administrative Templates: Windows Components","File Explorer: Allow the use of remote paths in file shortcut icons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,EnableShellShortcutIconRemotePath,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,EnableShellShortcutIconRemotePath,,,,0,,0,,=,,Medium, +1869,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium, +1732,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +1870,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium, +1874,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +1800,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +1826,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable Tamper Protection (Status)",MpComputerStatus,IsTamperProtected,,,,,,,,,,,True,,=,,Medium, +1801,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +1806,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Extensions,,,,,,,,=,,Medium, +1807,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions",MpPreferenceExclusion,ExclusionExtension,,,,,,,,,,,,,=,,Medium, +1808,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Paths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Paths,,,,,,,,=,,Medium, +1809,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions",MpPreferenceExclusion,ExclusionPath,,,,,,,,,,,,,=,,Medium, +1810,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Processes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Processes,,,,,,,,=,,Medium, +1811,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions",MpPreferenceExclusion,ExclusionProcess,,,,,,,,,,,,,=,,Medium, +1816,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +1817,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,=,,Medium, +1818,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,2,,=,,Medium, +1819,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +1820,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +1821,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +1822,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +1823,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +1824,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +1825,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +1812,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable sandboxing for Microsoft Defender Antivirus",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment",MP_FORCE_USE_SANDBOX,,,,,,,0,,1,,=,,Medium, +1900,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1901,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1916,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +1902,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1917,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +1903,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1918,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +1904,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1919,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +1905,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1920,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +1906,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1921,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +1907,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1922,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +1908,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,2,,=,,Medium, +1923,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,2,,=,,Medium, +1909,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1924,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +1910,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1925,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +1911,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1926,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,1,,=,,Medium, +1912,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1927,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +1913,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1928,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +1914,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1929,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +1915,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1930,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +1931,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1932,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +1933,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",33ddedf1-c6e0-47cb-833e-de6133960387,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1934,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode",MpPreferenceAsr,33ddedf1-c6e0-47cb-833e-de6133960387,,,,,,,,,0,,1,,=,,Medium, +1935,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +1936,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools",MpPreferenceAsr,c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,,,,,,,,,0,,1,,=,,Medium, +1966,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_ASROnlyExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,ExploitGuard_ASR_ASROnlyExclusions,,,,0,,0,,=,,Medium, +1967,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules",MpPreferenceExclusion,AttackSurfaceReductionOnlyExclusions,,,,,,,,,,,,,=|0,,Medium, +1965,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +1733,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +1734,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +1871,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium, +1735,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +1736,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +1872,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,,,0,,=,,Medium, +1737,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +1738,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +1739,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +1740,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +1741,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +1742,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +1743,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +1744,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +1745,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",ConnectedSearchPrivacy,,,,,,,1,,3,,=,,Medium, +2000,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +1873,"Administrative Templates: Windows Components","Windows AI: Allow Recall to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WindowsAI,AllowRecallEnablement,,,,,,,,,0,,=,,Medium, +2001,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +1746,"Administrative Templates: Windows Components","Windows Error Reporting: Disable Windows Error Reporting",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,,,,,,,0,,1,,=,,Medium, +1747,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +1748,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,0,,=,,Medium, +1749,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +1750,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +1751,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +1770,"Administrative Templates: Windows Components","Windows Installer: Disable Co-Installer (USB AutoInstall)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer",DisableCoInstallers,,,,,,,,,1,,=,,Medium, +1752,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +1776,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +2105,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low, +2106,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low, +2100,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +2101,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low, +2102,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Low, +2107,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low, +1753,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +1754,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +1755,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +1756,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +1757,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +1758,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +1759,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +1760,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +2201,"MS Security Guide","Lsass.exe audit mode",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe",AuditLevel,,,,,,,,,8,,=,,Low, +2202,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +2203,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +2209,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +2213,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +2214,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +2215,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +2216,"MS Security Guide","Enable Certificate Padding (32-bit subsystem on 64-bit OS)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +2204,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +2205,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +2206,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +2207,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +2208,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +2400,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +2411,"System Services","Disable mDNS in Dnscache service",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters,EnableMDNS,,,,,,,,,0,,=,,Medium, +2401,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +2402,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +2412,"System Services","WebClient (WebClient)",Registry,"",HKLM:\SYSTEM\CurrentControlSet\Services\WebClient,Start,,,,,,,3,,4,,=,,Medium, +2413,"System Services","WebClient (WebClient) (Service Startup type)",service,WebClient,,,,,,,,,Manual,,Disabled,,=,,Medium, +2403,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +2404,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +2405,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +2406,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +2407,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +2408,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +2409,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +2410,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +1950,"Microsoft Defender Exploit Guard","Exploit protection: Control flow guard (CFG)",Processmitigation,Cfg.Enable,,,,,,,,,On,,ON,,=,,Medium, +1951,"Microsoft Defender Exploit Guard","Exploit protection: Data Execution Prevention (DEP)",Processmitigation,DEP.Enable,,,,,,,,,On,,ON,,=,,Medium, +1952,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP)",Processmitigation,DEP.OverrideDEP,,,,,,,,,False,,False,,=,,Medium, +1954,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.ForceRelocateImages,,,,,,,,,Off,,ON,,=,,Medium, +1955,"Microsoft Defender Exploit Guard","Exploit protection: Override force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.OverrideForceRelocateImages,,,,,,,,,False,,False,,=,,Medium, +1956,"Microsoft Defender Exploit Guard","Exploit protection: Randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.BottomUp,,,,,,,,,On,,ON,,=,,Medium, +1957,"Microsoft Defender Exploit Guard","Exploit protection: Override randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.OverrideBottomUp,,,,,,,,,False,,False,,=,,Medium, +1958,"Microsoft Defender Exploit Guard","Exploit protection: High-entropy ASLR",Processmitigation,ASLR.HighEntropy,,,,,,,,,On,,ON,,=,,Medium, +1959,"Microsoft Defender Exploit Guard","Exploit protection: Override high-entropy ASLR",Processmitigation,ASLR.OverrideHighEntropy,,,,,,,,,False,,False,,=,,Medium, +1960,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP)",Processmitigation,SEHOP.Enable,,,,,,,,,On,,ON,,=,,Medium, +1961,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP (Telemetry only)",Processmitigation,SEHOP.TelemetryOnly,,,,,,,,,NOTSET,,OFF,,=,,Medium, +1962,"Microsoft Defender Exploit Guard","Exploit protection: Override validate exception chains (SEHOP)",Processmitigation,SEHOP.OverrideSEHOP,,,,,,,,,False,,False,,=,,Medium, +1963,"Microsoft Defender Exploit Guard","Exploit protection: Validate heap integrity",Processmitigation,HEAP.TerminateOnError,,,,,,,,,On,,ON,,=,,Medium, +1964,"Microsoft Defender Exploit Guard","Exploit protection: Override validate heap integrity",Processmitigation,HEAP.OverrideHEAP,,,,,,,,,False,,False,,=,,Medium, +1953,"Microsoft Defender Exploit Guard","Force use of Data Execution Prevention (DEP)",bcdedit,nx,,,,,,,,,OptIn,,AlwaysOn,,=,,Medium, +2300,"Windows Firewall",HardeningKitty-Block-TCP-NetBIOS,FirewallRule,"Any|Inbound|Block|TCP|137,138,139||",,,,,,,,,False,,True,,=,,Low, +2301,"Windows Firewall",HardeningKitty-Block-TCP-RDP,FirewallRule,Any|Inbound|Block|TCP|3389||,,,,,,,,,False,,True,,=,,Low, +2302,"Windows Firewall",HardeningKitty-Block-TCP-RPC,FirewallRule,"Any|Inbound|Block|TCP|135,593||",,,,,,,,,False,,True,,=,,Low, +2303,"Windows Firewall",HardeningKitty-Block-TCP-SMB,FirewallRule,Any|Inbound|Block|TCP|445||,,,,,,,,,False,,True,,=,,Low, +2304,"Windows Firewall",HardeningKitty-Block-TCP-WinRM,FirewallRule,"Any|Inbound|Block|TCP|5985,5986||",,,,,,,,,False,,True,,=,,Low, +2305,"Windows Firewall",HardeningKitty-Block-UDP-NetBIOS,FirewallRule,"Any|Inbound|Block|UDP|137,138,139||",,,,,,,,,False,,True,,=,,Low, +2306,"Windows Firewall",HardeningKitty-Block-UDP-RPC,FirewallRule,"Any|Inbound|Block|UDP|135,593||",,,,,,,,,False,,True,,=,,Low, +2307,"Windows Firewall",HardeningKitty-Block-calc-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\calc.exe|,,,,,,,,,False,,True,,=,,Low, +2308,"Windows Firewall",HardeningKitty-Block-calc-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\calc.exe|,,,,,,,,,False,,True,,=,,Low, +2309,"Windows Firewall",HardeningKitty-Block-certutil-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\certutil.exe|,,,,,,,,,False,,True,,=,,Low, +2310,"Windows Firewall",HardeningKitty-Block-certutil-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\certutil.exe|,,,,,,,,,False,,True,,=,,Low, +2311,"Windows Firewall",HardeningKitty-Block-conhost-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\conhost.exe|,,,,,,,,,False,,True,,=,,Low, +2312,"Windows Firewall",HardeningKitty-Block-conhost-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\conhost.exe|,,,,,,,,,False,,True,,=,,Low, +2313,"Windows Firewall",HardeningKitty-Block-cscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\cscript.exe|,,,,,,,,,False,,True,,=,,Low, +2314,"Windows Firewall",HardeningKitty-Block-cscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\cscript.exe|,,,,,,,,,False,,True,,=,,Low, +2315,"Windows Firewall",HardeningKitty-Block-mshta-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\mshta.exe|,,,,,,,,,False,,True,,=,,Low, +2316,"Windows Firewall",HardeningKitty-Block-mshta-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\mshta.exe|,,,,,,,,,False,,True,,=,,Low, +2317,"Windows Firewall",HardeningKitty-Block-notepad-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\notepad.exe|,,,,,,,,,False,,True,,=,,Low, +2318,"Windows Firewall",HardeningKitty-Block-notepad-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\notepad.exe|,,,,,,,,,False,,True,,=,,Low, +2319,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\RunScriptHelper.exe|,,,,,,,,,False,,True,,=,,Low, +2320,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\RunScriptHelper.exe|,,,,,,,,,False,,True,,=,,Low, +2321,"Windows Firewall",HardeningKitty-Block-wscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\wscript.exe|,,,,,,,,,False,,True,,=,,Low, +2322,"Windows Firewall",HardeningKitty-Block-wscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\wscript.exe|,,,,,,,,,False,,True,,=,,Low, diff --git a/vendor/lists/finding_list_0x6d69636b_user.csv b/vendor/lists/finding_list_0x6d69636b_user.csv new file mode 100644 index 0000000..2aad003 --- /dev/null +++ b/vendor/lists/finding_list_0x6d69636b_user.csv @@ -0,0 +1,57 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +4307,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Medium, +4308,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium, +4309,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Medium, +4310,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium, +4311,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Medium, +4312,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium, +4313,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0,,1,,=,,Medium, +4314,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Medium, +4315,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium, +4001,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +4100,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +4200,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +4201,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +4203,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows (User)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\WindowsAI,DisableAIDataAnalysis,,,,,,,0,,1,,=,,Medium, +4204,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot,TurnOffWindowsCopilot,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI,TurnOffWindowsCopilot,,,,0,,1,,=,,Medium, +4202,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +4304,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low, +4305,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low, +4300,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium, +4301,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low, +4302,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Low, +4306,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low, +4303,"Administrative Templates: Windows Components","Windows PowerShell: PowerShell Language Mode",LanguageMode,,,,,,,,,,FullLanguage,,ConstrainedLanguage,,=,,Medium, +4400,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,0,,2,,=,,Medium, +4401,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +4405,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +4406,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +4407,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +4408,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,4,,=,,Medium, +4409,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,4,,=,,Medium, +4402,"Office 2016 / Office 365","Microsoft Excel: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DontUpdateLinks,,,,,,,0,,1,,=,,Medium, +4403,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDEAllowed)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDEAllowed,,,,,,,1,,1,,=,,Medium, +4404,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDECleaned)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDECleaned,,,,,,,0,,1,,=,,Medium, +4424,"Office 2016 / Office 365","Microsoft Excel: Python Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,PythonFunctionWarnings,,,,,,,,,2,,=,,Medium, +4410,"Office 2016 / Office 365","Microsoft OneNote: Disable embedded files",Registry,,HKCU:\Software\Microsoft\Office\16.0\OneNote\Options,DisableEmbeddedFiles,,,,,,,0,,1,,=,,Medium, +4425,"Office 2016 / Office 365","Microsoft Outlook: Folder Home Pages for Outlook Special Folders: Do not allow Home Page URL to be set in folder Properties",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\webview,disable,,,,,,,,,1,,=,,Medium, +4426,"Office 2016 / Office 365","Microsoft Outlook: Outlook Today Settings: Outlook Today availability",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\today,disable,,,,,,,,,1,,=,,Medium, +4411,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +4412,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,4,,=,,Medium, +4415,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +4416,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,4,,=,,Medium, +4417,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,4,,=,,Medium, +4413,"Office 2016 / Office 365","Microsoft Word: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options,DontUpdateLinks,,,,,,,0,,1,,=,,Medium, +4414,"Office 2016 / Office 365","Microsoft Word (Mail): Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options\WordMail,DontUpdateLinks,,,,,,,0,,1,,=,,Medium, +4418,"Office 365","Disable the Office 365 Telemetry module",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,DisableTelemetry,,,,,,,,,1,,=,,Medium, +4419,"Office 365","Allow the use of connected experiences in Office",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,disconnectedstate,,,,,,,,,2,,=,,Low, +4420,"Office 365","Allow the use of connected experiences that analyze content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,usercontentdisabled,,,,,,,,,2,,=,,Low, +4421,"Office 365","Allow the use of connected experiences that download online content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,downloadcontentdisabled,,,,,,,,,2,,=,,Low, +4422,"Office 365","Allow the use of additional optional connected experiences",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,controllerconnectedservicesenabled,,,,,,,,,2,,=,,Low, +4423,"Office 365","Configure the level of client software diagnostic data sent by Office to Microsoft",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,sendtelemetry,,,,,,,,,3,,=,,Low, +4500,"Windows Settings","System: Notification & actions: Show me the Windows welcome experience after updates and occasionally when I sign in to highlight what's new and suggested",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-310093Enabled,,,,,,,1,,0,,=,,Low, +4501,"Windows Settings","System: Notification & actions: Get tips, tricks, and suggestions as you use Windows",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-338389Enabled,,,,,,,1,,0,,=,,Low, +4502,"Windows Settings","System: Shared experiences: Shared across devices 1",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,RomeSdkChannelUserAuthzPolicy,,,,,,,1,,0,,=,,Low, +4503,"Windows Settings","System: Shared experiences: Shared across devices 2",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,CdpSessionUserAuthzPolicy,,,,,,,1,,0,,=,,Low, +4504,"Windows Settings","Devices: Typing: Autocorrect misspelled words",Registry,,HKCU:\Software\Microsoft\TabletTip\1.7,EnableAutocorrection,,,,,,,1,,0,,=,,Low, +4505,"Windows Settings","Devices: AutoPlay: Use AutoPlay for all media and devices",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers,DisableAutoplay,,,,,,,0,,0,,=,,Low, diff --git a/vendor/lists/finding_list_4d5a_machine.csv b/vendor/lists/finding_list_4d5a_machine.csv new file mode 100644 index 0000000..86a1196 --- /dev/null +++ b/vendor/lists/finding_list_4d5a_machine.csv @@ -0,0 +1,4 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,ClassName,Namespace,Property,DefaultValue,RecommendedValue,Operator,Severity +2105,PowerShell,"Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,0,1,=,Low +2106,PowerShell,"Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,*,=,Low +2107,PowerShell,"Turn on PowerShell Transcription (Invocation Header)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,0,1,=,Low diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv new file mode 100644 index 0000000..cf95d75 --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv @@ -0,0 +1,129 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +225,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +281,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +281,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +283,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +228,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +274,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +273,"Security Options","System settings: Optional subsystems",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager\Subsystems",Optional,,,,,,,,,,,=,,Medium, +250,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,2,,=,,Medium, +251,"Security Options","Network security: Restrict NTLM: Incoming NTLM traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic,,,,,,2,,=,,Medium, +318,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +318,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +319,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +319,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +330,"System Services","Microsoft Store Install Service (InstallService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\InstallService,Start,,,,,,,3,,4,,=,,Medium, +330,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",service,InstallService,,,,,,,,,Manual,,Disabled,,=,,Medium, +340,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +340,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +322,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +322,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +346,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +346,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +327,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +327,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +329,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +329,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +334,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +334,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +333,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +333,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +335,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +335,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +332,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +332,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +350,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +350,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +347,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +347,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +337,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +337,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +325,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +325,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +336,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +336,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +316,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +316,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +352,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +352,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +342,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +342,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +344,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +344,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +353,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +353,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +355,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +355,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +354,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +354,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +23,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +28,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +29,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +29,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +29,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +29,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +30,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +30,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +30,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +30,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +31,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +31,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +31,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +31,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +31,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +32,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +36,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +47,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +48,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +49,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +58,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +66,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +67,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +69,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +70,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +70,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +71,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +72,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +73,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +75,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +77,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +76,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +78,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +79,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +80,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +80,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +82,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +83,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +91,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +92,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +93,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +104,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +108,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +122,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +123,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +125,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +128,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +129,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +130,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +132,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +133,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +140,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +141,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +144,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +150,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +151,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +156,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +154,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +155,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +166,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +176,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +179,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +184,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution (Execution Policy)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,ExecutionPolicy,,,,,,,,,AllSigned,,=,,Medium, +184,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,EnableScripts,,,,,,,,,1,,=,,Medium, +190,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +195,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +13,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +15,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +19,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv new file mode 100644 index 0000000..92e922a --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv @@ -0,0 +1,5 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +38,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +110,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +111,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +182,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv new file mode 100644 index 0000000..e52fd7a --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv @@ -0,0 +1,325 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +201,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +202,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +200,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,Medium, +203,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +204,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +205,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +207,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +206,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +208,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +288,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +289,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +292,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +287,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +307,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +285,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +308,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +277,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +278,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +295,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +298,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +299,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +301,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +300,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +290,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +315,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +280,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,"Guest;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +282,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +306,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +284,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +293,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +302,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +303,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +286,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +279,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +305,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +309,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +313,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +312,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +311,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +291,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +297,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +296,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +294,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +314,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +304,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +310,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +210,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +211,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +212,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +213,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +214,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +215,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +216,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableUIADesktopToggle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_AllowUIAccessApplicationsToPromptForElevation,,,,,,0,,=,,Medium, +217,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +218,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,1,,=,,Medium, +219,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +220,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +221,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +222,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +223,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +224,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +226,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +227,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +227,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +229,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +230,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +231,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +209,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +232,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +233,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +234,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +235,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +236,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +238,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +237,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +239,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +240,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +241,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +242,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +243,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +244,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +245,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +246,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +247,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +248,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +249,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +252,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +253,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +254,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,3,,=,,Medium, +255,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +256,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +257,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +258,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +259,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +260,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +261,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +262,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +263,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +264,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +265,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +266,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +267,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +268,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +269,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +270,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +271,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +272,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +275,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +276,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +320,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +320,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +317,"System Services","Diagnostics Tracking Service (DiagTrack)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\DiagTrack,Start,,,,,,,2,,4,,=,,Medium, +317,"System Services","Diagnostics Tracking Service (DiagTrack) (Service Startup type)",service,DiagTrack,,,,,,,,,Automatic,,Disabled,,=,,Medium, +351,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +351,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +324,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +324,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +338,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +338,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +339,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +339,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +321,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +321,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +343,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +343,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +345,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +345,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +349,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +349,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +358,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +358,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +360,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +360,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +357,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +357,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +359,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +359,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +323,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +323,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +326,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +326,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +328,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +328,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +331,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +331,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +341,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +341,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +348,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +348,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +356,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +356,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +361,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +362,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +363,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +364,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +371,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +372,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +373,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +374,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +365,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +366,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +367,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +368,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +369,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +370,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +20,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +22,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +24,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +24,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +25,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +26,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +27,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +33,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,1,,=,,Medium, +34,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +35,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +39,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +40,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +41,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +42,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +43,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +44,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +45,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +46,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +50,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +51,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +52,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +53,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +54,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +55,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +56,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +57,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +61,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +62,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +63,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +64,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +65,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +68,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +74,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +81,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +84,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +85,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +86,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +87,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +89,"Administrative Templates: System","Trusted Platform Module Services: Standard User Lockout Duration",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureDuration,,,,,,,,,30,,=,,Medium, +90,"Administrative Templates: System","Trusted Platform Module Services: Standard User Total Lockout Threshold",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureTotalThreshold,,,,,,,,,5,,=,,Medium, +88,"Administrative Templates: System","Trusted Platform Module Services: Ignore the default list of blocked TPM commands",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM\BlockedCommands,IgnoreDefaultList,,,,,,,,,0,,=,,Medium, +94,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +95,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +100,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitInkCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitInkCollection,,,,,,,,,1,,=,,Medium, +100,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitTextCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitTextCollection,,,,,,,,,1,,=,,Medium, +101,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +105,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +106,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +107,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +109,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +113,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +115,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +116,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +117,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +118,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +119,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +120,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +121,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowDeviceNameInTelemetry,,,,,,,1,,0,,=,,Medium, +124,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +127,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +131,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +134,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +135,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +136,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +137,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +138,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +139,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: End session when time limits are reached",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fResetBroken,,,,,,,,,1,,=,,Medium, +142,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +143,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +145,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +146,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +147,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +148,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +149,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +152,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +153,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +157,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +158,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +159,"Administrative Templates: Windows Components","Text Input: Improve inking and typing recognition",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput,AllowLinguisticDataCollection,,,,,,,,,0,,=,,Medium, +160,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,99,,=,,Medium, +161,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +162,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +163,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +164,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +165,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +167,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +168,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +169,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +170,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +171,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +173,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +174,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +174,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +175,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +177,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +178,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +180,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +183,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution (Execution Policy)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,ExecutionPolicy,,,,,,,,,RemoteSigned,,=,,Medium, +183,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,EnableScripts,,,,,,,,,1,,=,,Medium, +185,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +185,"Administrative Templates: Windows Components","Windows Update: Configure Automatic Updates: Configure automatic updating",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,AUOptions,,,,,,,,,4,,=,,Medium, +186,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +187,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +188,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, +189,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +191,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +192,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +193,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +194,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +196,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +197,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +198,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +199,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +5,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +21,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +6,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +7,"MSS (Legacy)","MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableDeadGWDetect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_EnableDeadGWDetect,,,,,,0,,=,,Medium, +8,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +9,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +12,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +14,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +16,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +17,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv new file mode 100644 index 0000000..5afaa4b --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv @@ -0,0 +1,12 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +37,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +96,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +97,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +98,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +99,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +102,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +103,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +112,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +114,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +126,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +181,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv new file mode 100644 index 0000000..0d7c0b4 --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv @@ -0,0 +1,293 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +201,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +202,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +200,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,Medium, +203,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +204,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +205,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +288,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +289,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +292,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +287,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +307,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +285,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +308,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +277,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +278,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +295,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +298,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +299,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +301,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +300,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +290,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +315,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +280,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,"Guest;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +282,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +306,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +284,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account;NT AUTHORITY\ANONYMOUS LOGON",,=,,Medium, +302,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +303,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +286,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +279,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +305,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +309,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +313,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +312,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +311,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +291,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +297,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +296,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +294,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +314,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +304,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +310,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +210,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +211,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +212,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +213,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +214,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +215,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +216,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableUIADesktopToggle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_AllowUIAccessApplicationsToPromptForElevation,,,,,,0,,=,,Medium, +217,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +218,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,1,,=,,Medium, +226,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +227,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +227,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +229,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +230,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +231,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +209,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +234,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +235,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +236,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +238,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +237,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +239,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +240,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +241,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +242,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +243,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +244,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +245,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +246,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +247,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +252,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +253,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +254,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,3,,=,,Medium, +255,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +256,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +257,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +258,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +259,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +260,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +261,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +262,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +263,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +264,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +265,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +266,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +267,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +268,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +269,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +270,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +271,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +272,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +275,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +276,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +320,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +320,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +317,"System Services","Diagnostics Tracking Service (DiagTrack)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\DiagTrack,Start,,,,,,,2,,4,,=,,Medium, +317,"System Services","Diagnostics Tracking Service (DiagTrack) (Service Startup type)",service,DiagTrack,,,,,,,,,Automatic,,Disabled,,=,,Medium, +351,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +351,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +324,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +324,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +338,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +338,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +339,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +339,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +321,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +321,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +343,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +343,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +345,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +345,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +349,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +349,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +358,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +358,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +360,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +360,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +357,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +357,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +359,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +359,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +323,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +323,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +326,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +326,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +328,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +328,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +331,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +331,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +341,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +341,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +348,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +348,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +356,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +356,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +371,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +372,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +373,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +374,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +365,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +366,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +367,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +368,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +369,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +370,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +20,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +22,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +33,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,1,,=,,Medium, +34,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +35,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +39,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +40,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +41,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +44,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +46,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +50,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +52,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +53,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +54,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +55,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +56,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +57,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +59,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +60,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +61,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +68,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +74,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +81,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +84,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +85,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +86,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +87,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +89,"Administrative Templates: System","Trusted Platform Module Services: Standard User Lockout Duration",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureDuration,,,,,,,,,30,,=,,Medium, +90,"Administrative Templates: System","Trusted Platform Module Services: Standard User Total Lockout Threshold",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureTotalThreshold,,,,,,,,,5,,=,,Medium, +88,"Administrative Templates: System","Trusted Platform Module Services: Ignore the default list of blocked TPM commands",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM\BlockedCommands,IgnoreDefaultList,,,,,,,,,0,,=,,Medium, +94,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +95,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +100,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitInkCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitInkCollection,,,,,,,,,1,,=,,Medium, +100,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitTextCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitTextCollection,,,,,,,,,1,,=,,Medium, +101,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +106,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +107,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +109,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +113,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +115,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +116,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +117,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +118,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +119,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +120,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +121,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowDeviceNameInTelemetry,,,,,,,1,,0,,=,,Medium, +124,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +127,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +131,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +134,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +135,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +136,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +137,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +138,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +139,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: End session when time limits are reached",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fResetBroken,,,,,,,,,1,,=,,Medium, +142,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +143,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +145,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +146,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +147,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +148,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +149,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +152,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +153,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +157,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +158,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +159,"Administrative Templates: Windows Components","Text Input: Improve inking and typing recognition",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput,AllowLinguisticDataCollection,,,,,,,,,0,,=,,Medium, +160,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,99,,=,,Medium, +161,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +162,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +163,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +164,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +165,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +167,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +168,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +169,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +170,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +171,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +172,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +173,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +174,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +174,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +175,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +177,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +178,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +180,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +183,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution (Execution Policy)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,ExecutionPolicy,,,,,,,,,RemoteSigned,,=,,Medium, +183,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,EnableScripts,,,,,,,,,1,,=,,Medium, +185,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +185,"Administrative Templates: Windows Components","Windows Update: Configure Automatic Updates: Configure automatic updating",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,AUOptions,,,,,,,,,4,,=,,Medium, +186,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +187,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +188,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, +189,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +191,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +192,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +193,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +194,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +196,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +197,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +198,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +199,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +5,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +21,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +6,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +7,"MSS (Legacy)","MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableDeadGWDetect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_EnableDeadGWDetect,,,,,,0,,=,,Medium, +8,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +9,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +12,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +14,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +16,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +17,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, diff --git a/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv b/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv new file mode 100644 index 0000000..5afaa4b --- /dev/null +++ b/vendor/lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv @@ -0,0 +1,12 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +37,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +96,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +97,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +98,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +99,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +102,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +103,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +112,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +114,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +126,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +181,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv new file mode 100644 index 0000000..9f08ed3 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv @@ -0,0 +1,584 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","Microsoft Store Install Service (InstallService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\InstallService,Start,,,,,,,3,,4,,=,,Medium, +5.13.2,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",service,InstallService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.14.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.14.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.15.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.3,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.5.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.45.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.45.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.47.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1,,1,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.1.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,1,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0,,1,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,,,1,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,,,0,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsOs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6,,7,,=,,Medium, +18.9.11.4.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for fixed data drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsFdv,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6,,7,,=,,Medium, +18.9.11.4.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for removable data drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsRdv,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,3,,4,,=,,Medium, +18.9.11.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1,,0,,=,,Medium, +18.9.45.2,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1,,0,,=,,Medium, +18.9.45.3,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1,,0,,=,,Medium, +18.9.45.4,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1,,0,,=,,Medium, +18.9.45.5,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2,,1,,=,,Medium, +18.9.45.6,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +18.9.45.7,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,,,yes,,=,,Medium, +18.9.45.8,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,,,0,,=,,Medium, +18.9.45.9,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,,,1,,=,,Medium, +18.9.45.10,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,,,1,,=,,Medium, +18.9.45.11,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +18.9.45.12,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.61.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.61.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.61.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.69.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.69.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.69.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.69.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.13.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.77.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.78.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.78.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.78.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow users to trust files that open in Windows Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,FileTrustCriteria,,,,,,,,,1,,!=,,Medium, +18.9.78.6,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.78.7,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.80.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.80.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +18.9.80.2.3,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.82.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.102.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv new file mode 100644 index 0000000..894a7aa --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv new file mode 100644 index 0000000..fa5eb24 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv @@ -0,0 +1,586 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","Microsoft Store Install Service (InstallService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\InstallService,Start,,,,,,,3,,4,,=,,Medium, +5.13.2,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",service,InstallService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.14.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.14.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.15.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1,,1,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.1.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,1,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0,,1,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.2.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.2.19,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.20,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.2.21,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,,,1,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,,,0,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1,,0,,=,,Medium, +18.9.45.2,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1,,0,,=,,Medium, +18.9.45.3,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1,,0,,=,,Medium, +18.9.45.4,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1,,0,,=,,Medium, +18.9.45.5,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2,,1,,=,,Medium, +18.9.45.6,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +18.9.45.7,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,,,yes,,=,,Medium, +18.9.45.8,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,,,0,,=,,Medium, +18.9.45.9,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,,,1,,=,,Medium, +18.9.45.10,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,,,1,,=,,Medium, +18.9.45.11,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +18.9.45.12,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.61.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.61.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.61.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.69.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.69.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.69.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.69.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.13.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.77.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.78.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.78.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.78.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow users to trust files that open in Windows Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,FileTrustCriteria,,,,,,,,,1,,!=,,Medium, +18.9.78.6,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.78.7,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.80.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.80.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +18.9.80.2.3,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.82.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.102.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv new file mode 100644 index 0000000..894a7aa --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv new file mode 100644 index 0000000..fa5eb24 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv @@ -0,0 +1,586 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","Microsoft Store Install Service (InstallService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\InstallService,Start,,,,,,,3,,4,,=,,Medium, +5.13.2,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",service,InstallService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.14.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.14.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.15.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1,,1,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.1.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,1,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0,,1,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.2.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.2.19,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.20,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.2.21,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,,,1,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,,,0,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1,,0,,=,,Medium, +18.9.45.2,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1,,0,,=,,Medium, +18.9.45.3,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1,,0,,=,,Medium, +18.9.45.4,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1,,0,,=,,Medium, +18.9.45.5,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2,,1,,=,,Medium, +18.9.45.6,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +18.9.45.7,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,,,yes,,=,,Medium, +18.9.45.8,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,,,0,,=,,Medium, +18.9.45.9,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,,,1,,=,,Medium, +18.9.45.10,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,,,1,,=,,Medium, +18.9.45.11,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +18.9.45.12,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.61.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.61.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.61.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.69.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.69.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.69.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.69.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.13.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.77.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.78.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.78.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.78.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.78.4,"Microsoft Defender Application Guard","Allow users to trust files that open in Windows Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,FileTrustCriteria,,,,,,,,,1,,!=,,Medium, +18.9.78.6,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.78.7,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.80.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.80.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +18.9.80.2.3,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.82.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.102.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv new file mode 100644 index 0000000..894a7aa --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv new file mode 100644 index 0000000..ad2e1eb --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv @@ -0,0 +1,583 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.24.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.25.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.26.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.27.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.27.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.28.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.29.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1,,1,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.1.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,1,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0,,1,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,,,1,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,,,0,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.45.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.45.4.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.45.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.45.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.45.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.45.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.45.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.45.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.45.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.46.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.46.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.46.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.46.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.46.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.46.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.48.1,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1,,0,,=,,Medium, +18.9.48.2,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1,,0,,=,,Medium, +18.9.48.3,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1,,0,,=,,Medium, +18.9.48.4,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1,,0,,=,,Medium, +18.9.48.5,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2,,1,,=,,Medium, +18.9.48.6,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +18.9.48.7,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,,,yes,,=,,Medium, +18.9.48.8,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,,,0,,=,,Medium, +18.9.48.9,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,,,1,,=,,Medium, +18.9.48.10,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,,,1,,=,,Medium, +18.9.48.11,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +18.9.48.12,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +18.9.48.13,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,,,1,,=,,Medium, +18.9.55.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.61.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.62.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.62.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.62.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.62.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.62.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.62.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.62.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.62.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.62.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.62.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.63.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.64.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.64.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.64.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.64.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.64.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.72.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.72.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.72.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.72.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.72.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.80.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.80.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.82.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.102.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv new file mode 100644 index 0000000..1e85241 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv @@ -0,0 +1,15 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.27.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.42.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.46.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv new file mode 100644 index 0000000..204268f --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv @@ -0,0 +1,588 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.24.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.25.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.26.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.27.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.27.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.28.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.29.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1,,1,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.1.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,1,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0,,1,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0,,0,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,"" +18.9.11.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,,,1,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,,,0,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,,,2.16.840.1.101.3.4.1.2;2.16.840.1.101.3.4.1.42,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.45.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.45.4.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.45.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.45.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.45.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.45.8.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.45.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.45.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.45.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.45.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.45.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.46.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.46.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.46.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.46.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.46.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.46.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.48.1,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1,,0,,=,,Medium, +18.9.48.2,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1,,0,,=,,Medium, +18.9.48.3,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1,,0,,=,,Medium, +18.9.48.4,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1,,0,,=,,Medium, +18.9.48.5,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2,,1,,=,,Medium, +18.9.48.6,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +18.9.48.7,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,,,yes,,=,,Medium, +18.9.48.8,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,,,0,,=,,Medium, +18.9.48.9,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,,,1,,=,,Medium, +18.9.48.10,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,,,1,,=,,Medium, +18.9.48.11,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +18.9.48.12,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +18.9.48.13,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,,,1,,=,,Medium, +18.9.55.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.61.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.62.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.62.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.62.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.62.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.62.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.62.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.62.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.62.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.62.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.62.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.63.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.64.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.64.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.64.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.64.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.64.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.72.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.72.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.72.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.72.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.72.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.80.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.80.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.82.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.102.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv new file mode 100644 index 0000000..00d9d23 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv @@ -0,0 +1,15 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv new file mode 100644 index 0000000..84b0e28 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv @@ -0,0 +1,567 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.18.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.19.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.24.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.25.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.26.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.27.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.27.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.28.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.29.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium, +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.45.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.45.4.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.45.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.45.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.45.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.45.8.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.45.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.45.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.45.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.45.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.45.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.46.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.46.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.46.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.46.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.46.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.46.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.55.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium, +18.9.56.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.62.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.63.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.63.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.63.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.63.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.63.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.63.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.63.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.63.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.63.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.63.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.63.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.63.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.63.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.63.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.64.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.65.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.65.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.65.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.65.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.65.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.70.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.73.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.73.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.73.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.73.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.73.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.81.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.81.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.81.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.81.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.83.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.86.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.86.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.87.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.96.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.96.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.98.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.98.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.98.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.98.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.98.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.98.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.98.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.99.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.100.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.103.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.103.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.103.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.103.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.103.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.103.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.103.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.103.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.103.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.103.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.103.5,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv new file mode 100644 index 0000000..00d9d23 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv @@ -0,0 +1,15 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv new file mode 100644 index 0000000..a403f88 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv @@ -0,0 +1,586 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.18.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.30.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.31.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.32.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.33.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.33.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.34.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.36.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.37.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.37.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.38.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.40.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.41.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.41.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.42.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.45.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.45.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.5.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.6.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.6.2,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.6.3,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.48.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.48.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.50.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.53.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.53.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,"" +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.9.14.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.14.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.17.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.17.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.9.17.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.17.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.9.17.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.9.17.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.9.17.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.18.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.27.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.27.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.27.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.27.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.27.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.27.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.27.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.27.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.31.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.31.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.31.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.41.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.46.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.47.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.47.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.47.5.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.47.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.47.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.47.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.47.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.47.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.47.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.47.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.48.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.48.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.48.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.48.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.48.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.48.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.57.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.64.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.65.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.65.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.65.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.9.65.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.65.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.9.65.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.65.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.65.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.65.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.65.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.65.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.65.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.67.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.67.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.67.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.67.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.67.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.72.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.75.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.75.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.75.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.75.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.75.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.81.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium, +18.9.85.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.85.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.85.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.85.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.87.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.89.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.89.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.90.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.90.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.90.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.91.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.100.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.9.100.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.102.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.102.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.102.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.102.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.102.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.102.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.102.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.103.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.104.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium, +18.9.104.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium, +18.9.105.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.108.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.108.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.108.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.108.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, +18.9.108.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.108.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.108.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.108.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.9.108.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.108.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.108.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv new file mode 100644 index 0000000..463ce08 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv new file mode 100644 index 0000000..e478365 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv @@ -0,0 +1,607 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.18.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.30.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.31.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.32.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.33.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.33.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.34.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.36.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.37.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.37.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.38.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.40.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.41.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.41.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.42.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.45.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.45.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.6,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.7,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.8,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.9.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.9.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.9.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.9.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.9.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.9.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.9.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +18.9.25.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.27.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.27.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.27.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.27.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.27.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.27.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.30.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.30.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.9.32.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.9.32.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.32.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.3.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.10.4.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.5.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.9.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.10.9.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.10.9.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.10.9.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.10.9.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.10.9.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.10.9.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium, +18.10.9.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.10.9.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.10.9.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.10.9.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.10.9.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.10.9.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.10.9.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,"" +18.10.9.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.10.9.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.10.9.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.10.9.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.10.9.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.10.9.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.10.9.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.10.9.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.10.9.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.10.9.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.10.9.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.10.9.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.10.9.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.10.9.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.10.9.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.10.9.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.10.9.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.14.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.16.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.33.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.10.35.1,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 as a standalone browser",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",NotifyDisableIEOptions,,,,,,,,,1,,=,,Medium, +18.10.37.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.44.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.10.44.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.10.44.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.10.44.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.10.44.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.10.44.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.10.50.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.10.59.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.59.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.59.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.66.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.10.66.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.10.66.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.10.66.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.10.66.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.10.72.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium, +18.10.76.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.76.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.10.76.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.10.78.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +10.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.91.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium, +18.10.91.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.93.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium, +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv new file mode 100644 index 0000000..6945629 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv new file mode 100644 index 0000000..6a7c833 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv @@ -0,0 +1,613 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.29.3,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,WDAGUtilityAccount,,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +2.3.11.12,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.18.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.30.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.31.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.32.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.33.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.33.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.34.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.36.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.37.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.37.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.38.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.40.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.41.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.41.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.42.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.45.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.45.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.6,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.7,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.8,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.9,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.9.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.9.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.9.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.9.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.9.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.9.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.9.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium, +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium, +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium, +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium, +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium, +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium, +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium, +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.9.33.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.33.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.3.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.10.4.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.5.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.9.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.10.9.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.10.9.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.10.9.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.10.9.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.10.9.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.10.9.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium, +18.10.9.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.10.9.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.10.9.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.10.9.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.10.9.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.10.9.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.10.9.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.10.9.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.10.9.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,"" +18.10.9.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.10.9.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.10.9.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.10.9.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.10.9.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.10.9.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.10.9.2.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium, +18.10.9.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.10.9.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.10.9.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.10.9.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.10.9.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.10.9.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.10.9.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.10.9.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.10.9.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.10.9.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.10.9.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.10.9.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.10.9.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.10.9.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.10.9.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.14.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.16.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.25.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.25.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.25.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.25.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.25.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.25.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.25.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.25.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.28.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.34.1,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 as a standalone browser",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",NotifyDisableIEOptions,,,,,,,,,1,,=,,Medium, +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.42.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.42.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.42.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.42.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.42.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.42.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.42.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.42.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +18.10.42.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.42.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.42.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.42.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.43.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.10.43.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.10.43.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.10.43.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.10.43.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.10.43.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.10.49.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium, +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.55.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.56.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.56.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.10.56.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.10.56.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.56.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.10.56.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium, +18.10.56.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.56.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.56.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.56.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.56.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.56.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.56.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.58.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.58.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.10.58.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.10.58.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.58.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.10.58.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.62.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.65.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.10.65.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.10.65.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.10.65.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.10.65.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.10.71.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium, +18.10.75.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.75.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.77.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.10.79.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.79.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.80.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +10.10.81.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.86.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.86.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.88.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.88.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.88.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.88.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.88.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.88.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.88.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.89.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium, +18.10.90.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium, +18.10.91.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.92.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.92.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.92.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium, +18.10.92.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.92.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.92.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.92.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.92.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.92.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.92.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv new file mode 100644 index 0000000..0f85dc9 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.42.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.44.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv new file mode 100644 index 0000000..a403f88 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv @@ -0,0 +1,586 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium, +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium, +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium, +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium, +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium, +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium, +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium, +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium, +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=,,Medium, +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium, +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium, +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium, +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium, +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium, +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium, +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium, +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium, +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium, +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium, +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium, +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium, +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.18.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.18.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium, +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium, +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium, +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium, +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium, +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium, +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium, +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium, +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium, +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium, +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium, +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium, +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.30.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=,,Medium, +5.30.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium, +5.31.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium, +5.31.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.32.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium, +5.32.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.33.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium, +5.33.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium, +5.34.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium, +5.34.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.35.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium, +5.35.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.36.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium, +5.36.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium, +5.37.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium, +5.37.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.38.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium, +5.38.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.39.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium, +5.39.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.40.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium, +5.40.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.41.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium, +5.41.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium, +5.42.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +5.42.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.43.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +5.43.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.44.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +5.44.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +5.45.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +5.45.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.5.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.5.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +18.6.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.6.2,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.6.3,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium, +18.8.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium, +18.8.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +18.8.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium, +18.8.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium, +18.8.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium, +18.8.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +18.8.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +18.8.34.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.48.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.48.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.50.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.53.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.53.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.11.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium, +18.9.11.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium, +18.9.11.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium, +18.9.11.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium, +18.9.11.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium, +18.9.11.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium, +18.9.11.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +18.9.11.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium, +18.9.11.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium, +18.9.11.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium, +18.9.11.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium, +18.9.11.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,"" +18.9.11.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +18.9.11.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium, +18.9.11.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium, +18.9.11.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium, +18.9.11.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium, +18.9.11.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium, +18.9.11.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium, +18.9.11.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium, +18.9.11.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium, +18.9.11.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium, +18.9.11.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium, +18.9.11.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium, +18.9.11.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium, +18.9.11.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +18.9.11.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +18.9.11.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.9.14.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.14.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.17.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.17.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.9.17.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.17.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.9.17.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.9.17.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.9.17.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.18.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +18.9.27.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.27.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.27.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.27.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.27.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.27.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.27.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.27.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.31.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.31.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.31.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium, +18.9.41.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.46.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.47.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.47.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.47.5.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.47.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.47.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.47.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.47.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.47.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.47.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.47.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.48.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium, +18.9.48.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium, +18.9.48.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium, +18.9.48.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium, +18.9.48.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium, +18.9.48.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium, +18.9.57.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.64.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.65.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.65.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium, +18.9.65.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.9.65.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.65.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.9.65.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.65.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.65.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.65.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.65.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.65.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.65.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.67.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.67.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium, +18.9.67.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.9.67.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.67.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium, +18.9.72.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.75.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium, +18.9.75.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium, +18.9.75.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium, +18.9.75.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium, +18.9.75.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium, +18.9.81.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium, +18.9.85.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.85.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.85.2.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +18.9.85.2.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +18.9.87.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +18.9.89.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.89.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.90.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.90.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.90.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.91.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.100.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.9.100.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.102.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.102.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.102.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.102.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.102.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.102.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.102.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.103.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.104.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium, +18.9.104.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium, +18.9.105.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.108.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.9.108.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.108.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.108.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,>=,,Medium, +18.9.108.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.108.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.108.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.108.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.9.108.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.108.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.108.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv new file mode 100644 index 0000000..463ce08 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv new file mode 100644 index 0000000..997ba7c --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv @@ -0,0 +1,614 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low,L1 +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low,L1 +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low,L1 +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium,L1 +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium,L1 +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium,L1 +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High,L1 +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low,L1 +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium,L1 +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium,L1 +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium,L1 +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium,L1 +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium,L1 +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium,L1 +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium,L1 +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium,L1 +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium,L1 +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L2 +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium,L2 +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium,L2 +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium,L1 +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium,L1 +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low,L1 +2.3.1.2,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium,L1 +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium,L1 +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low,L1 +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low,L1 +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low,L1 +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low,L1 +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,2,,=,,Medium,L1 +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium,L2 +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium,L1 +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium,L1 +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium,L1 +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium,L1 +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low,L1 +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low,L1 +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium,BL +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium,L1 +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium,L2 +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low,L1 +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low,L1 +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low,L1 +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium,L1 +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium,L1 +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium,L1 +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium,L1 +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium,L1 +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium,L1 +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium,L1 +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium,L1 +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium,L1 +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium,L1 +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium,L1 +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium,L1 +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium,L1 +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium,L1 +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium,L1 +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium,L1 +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium,L1 +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium,L1 +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium,L1 +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium,L1 +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High,L1 +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low,L1 +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium,L1 +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium,L1 +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium,L1 +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium,L1 +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium,L2 +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium,L1 +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium,L1 +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium,L1 +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium,L1 +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium,L1 +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium,L1 +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium,L1 +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium,L1 +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium,L2 +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=|0,,Medium,L2 +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium,L1 +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium,L2 +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.8.1,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.8.2,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium,L1 +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium,L2 +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium,L1 +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.14.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.14.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.15.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.15.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.16.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.16.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.17.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium,L2 +5.17.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.18.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium,L2 +5.18.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.19.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium,L2 +5.19.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.20.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium,L2 +5.20.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.21.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium,L2 +5.21.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.22.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.22.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.23.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.23.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.24.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.24.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.25.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium,L2 +5.25.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium,L2 +5.26.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium,L1 +5.26.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium,L1 +5.27.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium,L2 +5.27.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.28.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium,L1 +5.28.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.29.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium,L2 +5.29.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium,L2 +5.30.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.30.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.31.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.31.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.32.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.32.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.33.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.33.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.34.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.34.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.35.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.35.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.36.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.36.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium,L1 +5.37.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.37.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.38.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium,L2 +5.38.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.39.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium,L2 +5.39.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.40.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium,L2 +5.40.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.41.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.41.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.42.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.42.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.43.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.43.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.44.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.44.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.45.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.45.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,L1 +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low,L1 +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,L1 +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low,L1 +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,L1 +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low,L1 +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,L1 +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low,L1 +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low,L1 +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low,L1 +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium,L1 +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium,L2 +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium,L1 +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium,L1 +18.3.3,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium,L1 +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium,L1 +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium,L1 +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium,L1 +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium,L1 +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium,L1 +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium,L1 +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium,L1 +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium,L1 +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,L1 +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High,L1 +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium,L1 +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium,L1 +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium,L1 +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium,L2 +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,L1 +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium,L2 +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium,L1 +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium,L2 +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,L1 +18.5.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium,L1 +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium,L2 +18.5.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium,L2 +18.5.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium,L1 +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium,L1 +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium,L1 +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,L1 +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium,L2 +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium,L1 +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium,L2 +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium,L1 +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium,L1 +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium,L1 +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium,L1 +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium,L1 +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium,L2 +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium,L2 +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium,L2 +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium,L1 +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium,L1 +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium,L1 +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium,L1 +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium,L1 +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium,L1 +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium,L1 +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium,L1 +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium,L1 +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium,L1 +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,L2 +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,L1 +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium,L1 +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium,L1 +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium,L1 +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium,L1 +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium,L1 +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,L1 +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium,L1 +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium,L1 +18.9.5.7,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium,L1 +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,BL +18.9.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium,BL +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,BL +18.9.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,BL +18.9.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium,BL +18.9.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium,BL +18.9.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium,BL +18.9.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium,BL +18.9.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,BL +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium,L1 +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium,L1 +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium,L1 +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium,L1 +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium,L1 +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium,L1 +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium,L1 +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium,L1 +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium,L2 +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium,L2 +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,L2 +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium,L2 +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium,L2 +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium,L2 +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium,L2 +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium,L2 +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,BL +18.9.25.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium,L1 +18.9.25.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium,L1 +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium,L2 +18.9.27.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium,L1 +18.9.27.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium,L1 +18.9.27.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium,L1 +18.9.27.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium,L1 +18.9.27.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium,L1 +18.9.27.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium,L1 +18.9.27.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium,L1 +18.9.30.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,L2 +18.9.30.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,L2 +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.32.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium,BL +18.9.32.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium,BL +18.9.32.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium,L1 +18.9.32.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium,L1 +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,L1 +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium,L1 +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium,L1 +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium,L2 +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,L2 +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,L2 +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,L2 +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,L2 +18.10.3.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium,L1 +18.10.4.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium,L1 +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium,L1 +18.10.5.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium,L2 +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium,L1 +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium,L1 +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium,L1 +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,L1 +18.10.9.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.9.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium,BL +18.10.9.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.9.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.9.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.9.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.9.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium,BL +18.10.9.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium,BL +18.10.9.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium,BL +18.10.9.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium,BL +18.10.9.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium,BL +18.10.9.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.9.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.9.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,BL +18.10.9.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.9.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,BL +18.10.9.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium,BL +18.10.9.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.9.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium,BL +18.10.9.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium,BL +18.10.9.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium,BL +18.10.9.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium,BL +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium,L2 +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,L1 +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium,L2 +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,L1 +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium,L1 +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,L1 +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium,L1 +18.10.14.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium,L1 +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,L1 +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium,L2 +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium,L1 +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,L1 +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium,L1 +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,L1 +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,L1 +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium,L1 +18.10.16.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium,L1 +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium,L1 +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium,L1 +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium,L1 +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium,L1 +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium,L1 +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium,L1 +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium,L1 +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium,L1 +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium,L1 +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium,L1 +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium,L1 +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium,L2 +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium,L1 +18.10.29.5,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium,L1 +18.10.33.1,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium,L1 +18.10.37.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,L2 +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium,L2 +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium,L1 +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium,L1 +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium,L2 +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium,L1 +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium,L2 +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium,L1 +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium,L1 +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium,L2 +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium,L1 +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium,L1 +18.10.44.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium,L1 +18.10.44.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium,L1 +18.10.44.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium,L1 +18.10.44.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium,L1 +18.10.44.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium,L1 +18.10.44.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium,L1 +18.10.50.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium,L2 +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,L1 +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium,L2 +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium,L2 +18.10.57.2.3,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium,L1 +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium,L2 +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium,L1 +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium,L2 +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium,L1 +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium,L1 +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium,L2 +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium,L2 +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium,L1 +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium,L1 +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,L2 +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium,L1 +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium,L1 +18.10.59.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium,L1 +18.10.59.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium,L1 +18.10.59.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium,L2 +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium,L2 +18.10.66.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium,L2 +18.10.66.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium,L1 +18.10.66.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium,L1 +18.10.66.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium,L1 +18.10.66.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium,L2 +18.10.72.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium,L1 +18.10.76.1.1,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium,L1 +18.10.76.1.2,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium,L1 +18.10.76.1.3,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium,L1 +18.10.76.1.4,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium,L1 +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium,L1 +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium,L1 +18.10.76.3.1,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium,L1 +18.10.76.3.2,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium,L1 +18.10.78.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium,L1 +18.10.79.1,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",Registry,,HKLM:\SOFTWARE\Microsoft\Policies\PassportForWork\Biometrics,EnableESSwithSupportedPeripherals,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\PassportForWork,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\PassportForWork,EnableESSwithSupportedPeripherals,,,,,,1,,=,,Medium,L1 +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium,L2 +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium,L1 +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium,L1 +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,L2 +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium,L1 +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium,L1 +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium,L1 +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium,L1 +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium,L1 +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium,L1 +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium,L1 +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium,L1 +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,L2 +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium,L1 +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium,L1 +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,L2 +18.10.91.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium,L1 +18.10.91.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium,L1 +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium,L1 +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium,L1 +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium,L1 +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium,L1 +18.10.93.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium,L1 +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium,L1 +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium,L1 +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium,L1 +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low,L1 +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium,L1 +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium,L1 +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium,L1 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv new file mode 100644 index 0000000..1700836 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium,L1 +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium,L1 +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium,L1 +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,L1 +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,L2 +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium,L1 +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium,L1 +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium,L1 +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,L1 +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,L2 +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium,L2 +19.7.7.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium,L1 +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium,L1 +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium,L2 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv new file mode 100644 index 0000000..fee8200 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv @@ -0,0 +1,622 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low,L1 +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low,L1 +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low,L1 +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium,L1 +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium,L1 +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium,L1 +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High,L1 +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low,L1 +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium,L1 +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium,L1 +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium,L1 +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium,L1 +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium,L1 +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium,L1 +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium,L1 +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium,L1 +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium,L1 +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L2 +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,,Medium,L2 +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines",,=,,Medium,L2 +2.2.29.3,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,WDAGUtilityAccount,,=,,Medium,L2 +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium,L1 +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium,L1 +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low,L1 +2.3.1.2,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium,L1 +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium,L1 +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low,L1 +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low,L1 +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low,L1 +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low,L1 +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium,L2 +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium,L1 +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium,L1 +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium,L1 +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium,L1 +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low,L1 +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low,L1 +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,,<=!0,,Medium,BL +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium,L1 +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium,L2 +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low,L1 +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low,L1 +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low,L1 +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium,L1 +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium,L1 +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium,L1 +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium,L1 +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium,L1 +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,,>=,,Medium,L1 +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium,L1 +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium,L1 +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium,L1 +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium,L1 +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium,L1 +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium,L1 +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium,L1 +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium,L1 +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium,L1 +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium,L1 +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium,L1 +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium,L1 +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium,L1 +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium,L1 +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High,L1 +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low,L1 +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium,L1 +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium,L1 +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium,L1 +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium,L1 +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium,L1 +2.3.11.12,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium,L1 +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,>=,,Medium,L2 +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium,L1 +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium,L1 +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium,L1 +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium,L1 +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium,L1 +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium,L1 +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium,L1 +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium,L1 +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,,=,,Medium,L2 +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,,=|0,,Medium,L1 +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,,=,,Medium,L2 +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.5.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.5.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.6.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.6.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.7.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.7.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.8.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.8.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.9.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,,=|0,,Medium,L1 +5.9.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.10.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.10.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.11.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,,=,,Medium,L2 +5.11.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.12.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,,=|0,,Medium,L1 +5.12.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.13.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.13.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.14.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.14.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.15.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.15.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.16.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,,=,,Medium,L2 +5.16.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.17.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium,L2 +5.17.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.18.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,,=,,Medium,L2 +5.18.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.19.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,,=,,Medium,L2 +5.19.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.20.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,,=,,Medium,L2 +5.20.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.21.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.21.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.22.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,,=,,Medium,L2 +5.22.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.23.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.23.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.24.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,,=,,Medium,L2 +5.24.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,,=,,Medium,L2 +5.25.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,,=,,Medium,L1 +5.25.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,,=,,Medium,L1 +5.26.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,,=,,Medium,L2 +5.26.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.27.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,,=|0,,Medium,L1 +5.27.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.28.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,,=|0,,Medium,L2 +5.28.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,,=|0,,Medium,L2 +5.29.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.29.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,,=|0,,Medium,L1 +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,,=,,Medium,L2 +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,,=|0,,Medium,L1 +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,,=|0,,Medium,L1 +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,,=,,Medium,L2 +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,,=,,Medium,L2 +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,,=,,Medium,L2 +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,,=,,Medium,L2 +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,,=|0,,Medium,L1 +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,,=|0,,Medium,L1 +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium,L1 +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,L1 +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low,L1 +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low,L1 +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low,L1 +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,L1 +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low,L1 +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low,L1 +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low,L1 +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium,L1 +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium,L2 +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium,L1 +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium,L1 +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium,L1 +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium,L1 +18.4.5,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,L1 +18.4.6,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium,L1 +18.4.7,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,L1 +18.4.8,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High,L1 +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium,L1 +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium,L1 +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium,L1 +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium,L2 +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,L1 +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium,L2 +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium,L1 +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium,L2 +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,L1 +18.5.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium,L1 +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,=,,Medium,L2 +18.5.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,=,,Medium,L2 +18.5.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium,L1 +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium,L1 +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium,L1 +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,L1 +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium,L2 +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium,L1 +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium,L2 +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium,L1 +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium,L1 +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium,L1 +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium,L1 +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium,L1 +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium,L2 +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium,L2 +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium,L2 +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium,L1 +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium,L1 +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium,L1 +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium,L1 +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium,L1 +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium,L1 +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium,L1 +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium,L1 +18.7.8,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium,L1 +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium,L1 +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,L2 +18.8.2,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0,,1,,=,,Medium,L2 +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,L1 +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium,L1 +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium,L1 +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium,L1 +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium,L1 +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium,L1 +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,L1 +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium,L1 +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium,L1 +18.9.5.7,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium,L1 +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,BL +18.9.7.1.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium,BL +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,BL +18.9.7.1.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,BL +18.9.7.1.5.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium,BL +18.9.7.1.5.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,,=,,Medium,BL +18.9.7.1.5.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,,=,,Medium,BL +18.9.7.1.5.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,,=,,Medium,BL +18.9.7.1.6,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,BL +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium,L1 +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium,L1 +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium,L1 +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium,L1 +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium,L1 +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium,L1 +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium,L1 +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium,L1 +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium,L1 +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium,L1 +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium,L2 +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium,L2 +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,L2 +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium,L2 +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium,L2 +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium,L2 +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium,L2 +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium,L2 +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,BL +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium,L1 +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium,L1 +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium,L1 +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium,L1 +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium,L1 +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium,L1 +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium,L1 +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium,L1 +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium,L2 +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium,L1 +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium,L1 +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium,L1 +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium,L1 +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium,L1 +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium,L1 +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium,L1 +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,L2 +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,L2 +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium,BL +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium,BL +18.9.33.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium,L1 +18.9.33.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium,L1 +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,L1 +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium,L1 +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium,L2 +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium,L2 +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,L2 +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,L1 +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,L1 +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,L2 +18.10.3.2,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium,L1 +18.10.4.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium,L1 +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium,L1 +18.10.5.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium,L2 +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium,L1 +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium,L1 +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium,L1 +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,L1 +18.10.9.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.9.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium,BL +18.10.9.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.9.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.9.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.9.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.9.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium,BL +18.10.9.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium,BL +18.10.9.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium,BL +18.10.9.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium,BL +18.10.9.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium,BL +18.10.9.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.9.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.9.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.9.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.9.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,BL +18.10.9.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.9.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,BL +18.10.9.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium,BL +18.10.9.2.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,BL +18.10.9.2.16,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,BL +18.10.9.2.17,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,BL +18.10.9.2.18,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,BL +18.10.9.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.9.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium,BL +18.10.9.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.9.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.9.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium,BL +18.10.9.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium,BL +18.10.9.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium,BL +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium,L2 +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,L1 +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium,L2 +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,L1 +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium,L1 +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,L1 +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium,L1 +18.10.14.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium,L1 +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,L1 +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium,L2 +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium,L1 +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,L1 +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium,L1 +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,L1 +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,L1 +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium,L1 +18.10.16.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium,L1 +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium,L1 +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium,L1 +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium,L1 +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium,L1 +18.10.25.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium,L1 +18.10.25.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.25.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium,L1 +18.10.25.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium,L1 +18.10.25.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium,L1 +18.10.25.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium,L1 +18.10.25.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium,L1 +18.10.25.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.28.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium,L2 +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium,L1 +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium,L1 +18.10.28.5,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium,L1 +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,L2 +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium,L2 +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium,L1 +18.10.42.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium,L1 +18.10.42.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium,L2 +18.10.42.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.42.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium,L1 +18.10.42.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium,L1 +18.10.42.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium,L1 +18.10.42.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.42.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.42.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium,L1 +18.10.42.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium,L2 +18.10.42.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium,L1 +18.10.42.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium,L1 +18.10.42.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium,L1 +18.10.42.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium,L1 +18.10.42.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium,L1 +18.10.43.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium,L1 +18.10.43.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium,L1 +18.10.43.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium,L1 +18.10.43.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium,L1 +18.10.43.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium,L1 +18.10.43.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium,L1 +18.10.49.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium,L2 +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,L1 +18.10.55.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium,L2 +18.10.56.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium,L2 +18.10.56.2.3,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium,L1 +18.10.56.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium,L2 +18.10.56.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium,L2 +18.10.56.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium,L2 +18.10.56.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium,L1 +18.10.56.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium,L2 +18.10.56.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium,L2 +18.10.56.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium,L2 +18.10.56.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium,L2 +18.10.56.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium,L1 +18.10.56.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium,L1 +18.10.56.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium,L1 +18.10.56.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium,L1 +18.10.56.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium,L1 +18.10.56.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium,L2 +18.10.56.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium,L2 +18.10.56.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium,L1 +18.10.57.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium,L1 +18.10.58.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,L2 +18.10.58.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium,L1 +18.10.58.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium,L1 +18.10.58.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium,L1 +18.10.58.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium,L1 +18.10.58.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium,L2 +18.10.62.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium,L2 +18.10.65.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium,L2 +18.10.65.2,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,,,1,,=,,Medium,L1 +18.10.65.3,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium,L1 +18.10.65.4,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium,L1 +18.10.65.5,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium,L2 +18.10.71.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium,L1 +18.10.75.1.1,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Automatic Data Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,CaptureThreatWindow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,AutomaticDataCollection,,,,,,1,,=,,Medium,L1 +18.10.75.1.2,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium,L1 +18.10.75.1.3,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium,L1 +18.10.75.1.4,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium,L1 +18.10.75.1.5,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium,L1 +18.10.75.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium,L1 +18.10.75.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium,L1 +18.10.77.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium,L1 +18.10.78.1,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",Registry,,HKLM:\SOFTWARE\Microsoft\Policies\PassportForWork\Biometrics,EnableESSwithSupportedPeripherals,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\PassportForWork,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\PassportForWork,EnableESSwithSupportedPeripherals,,,,,,1,,=,,Medium,L1 +18.10.79.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium,L2 +18.10.79.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium,L1 +18.10.80.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium,L1 +18.10.80.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +18.10.80.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,L2 +18.10.81.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium,L1 +18.10.81.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium,L1 +18.10.86.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium,L2 +18.10.86.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium,L2 +18.10.88.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium,L1 +18.10.88.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium,L1 +18.10.88.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium,L1 +18.10.88.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium,L1 +18.10.88.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,L2 +18.10.88.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium,L1 +18.10.88.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium,L1 +18.10.89.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,L2 +18.10.90.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium,L1 +18.10.90.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium,L1 +18.10.91.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium,L1 +18.10.92.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium,L1 +18.10.92.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium,L1 +18.10.92.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium,L1 +18.10.92.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium,L1 +18.10.92.2.4,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Enable features introduced via servicing that are off by default",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,AllowTemporaryEnterpriseFeatureControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowTemporaryEnterpriseFeatureControl,,,,,,0,,=,,Medium,L1 +18.10.92.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium,L1 +18.10.92.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium,L1 +18.10.92.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium,L1 +18.10.92.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low,L1 +18.10.92.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium,L1 +18.10.92.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium,L1 +18.10.92.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium,L1 +18.10.92.4.4,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Enable optional updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetAllowOptionalContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowOptionalContent,,,,,,0,,=,,Medium,L1 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv new file mode 100644 index 0000000..1aa6316 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv @@ -0,0 +1,14 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,L1 +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,L2 +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium,L1 +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium,L1 +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium,L1 +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,L1 +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,L2 +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium,L2 +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium,L1 +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium,L1 +19.7.38.1,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot,TurnOffWindowsCopilot,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI,TurnOffWindowsCopilot,,,,0,,1,,=,,Medium,L1 +19.7.42.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +19.7.44.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium,L2 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv new file mode 100644 index 0000000..434d94e --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv @@ -0,0 +1,651 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,24,>=,>=,Low,L1 +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,365,<=!0,<=!0,Low,L1 +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,1,>=,>=,Low,L1 +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,14,>=,>=,Medium,L1 +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,1,=,=,Medium,L1 +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,1,=,=,Medium,L1 +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,0,=,=,High,L1 +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,15,>=,>=,Low,L1 +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,5,<=!0,<=!0,Low,L1 +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,1,=,=,Medium,L1 +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,15,>=,>=,Low,L1 +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators","BUILTIN\Remote Desktop Users;BUILTIN\Administrators",=,=,Medium,L1 +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,BUILTIN\Users;BUILTIN\Administrators,=,=,Medium,L1 +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators","BUILTIN\Remote Desktop Users;BUILTIN\Administrators",=,=,Medium,L1 +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE","BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.9,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE","BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.10,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.11,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.12,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.13,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.14.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.14.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators","NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",=,=,Medium,L1 +2.2.15,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.16,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account","BUILTIN\Guests;NT AUTHORITY\Local account",=,=,Medium,L1 +2.2.17,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.18,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.19,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.20,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account","BUILTIN\Guests;NT AUTHORITY\Local account",=,=,Medium,L1 +2.2.21,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.22,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.23,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.24,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.25,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators","Window Manager\Window Manager Group;BUILTIN\Administrators",=,=,Medium,L1 +2.2.26,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.27,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.28,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L2 +2.2.29.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,=,Medium,L2 +2.2.29.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines","NT VIRTUAL MACHINE\Virtual Machines",=,=,Medium,L2 +2.2.29.3,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,WDAGUtilityAccount,WDAGUtilityAccount,=,=,Medium,L2 +2.2.30,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.31,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.32,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.33,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.34,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.35,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators","NT SERVICE\WdiServiceHost;BUILTIN\Administrators",=,=,Medium,L1 +2.2.36,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.37,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.38,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,BUILTIN\Users;BUILTIN\Administrators,=,=,Medium,L1 +2.2.39,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.3.1.1,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,False,=,=,Medium,L1 +2.3.1.2,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,1,=,=,Medium,L1 +2.3.1.3,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,Administrator,!=,!=,Low,L1 +2.3.1.4,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,Guest,!=,!=,Low,L1 +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,1,=,=,Low,L1 +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,0,=,=,Low,L1 +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,1,=,=,Medium,L2 +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,1,=,=,Medium,L1 +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,1,=,=,Medium,L1 +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,1,=,=,Medium,L1 +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,0,=,=,Medium,L1 +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,30,<=!0,<=!0,Medium,L1 +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,1,=,=,Medium,L1 +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,0,=,=,Low,L1 +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,1,=,=,Low,L1 +2.3.7.3,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10,,10,10,<=!0,<=!0,Medium,BL +2.3.7.4,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,900,<=!0,<=!0,Medium,L1 +2.3.7.5,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,!=,Low,L1 +2.3.7.6,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,!=,Low,L1 +2.3.7.7,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,4,<=,<=,Medium,L2 +2.3.7.8.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,14,<=,<=,Low,L1 +2.3.7.8.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,5,>=,>=,Low,L1 +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,1,=,=,Low,L1 +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,1,=,=,Medium,L1 +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,1,=,=,Medium,L1 +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,0,=,=,Medium,L1 +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,15,<=,<=,Medium,L1 +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,1,=,=,Medium,L1 +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,1,=,=,Medium,L1 +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,1,=,=,Medium,L1 +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,1,>=,>=,Medium,L1 +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,0,=,=,Medium,L1 +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,1,=,=,Medium,L1 +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,1,=,=,Medium,L1 +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,1,=,=,Medium,L1 +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,0,=,=,Medium,L1 +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,=,Medium,L1 +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion","System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",=,=,Medium,L1 +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog","System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",=,=,Medium,L1 +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,1,=,=,Medium,L1 +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),O:BAG:BAD:(A;;RC;;;BA),=,=,Medium,L1 +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,=,Medium,L1 +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,0,=,=,Medium,L1 +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,1,=,=,Medium,L1 +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,0,=,=,Medium,L1 +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,0,=,=,Medium,L1 +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,2147483640,<=,<=,Medium,L1 +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,1,=,=,High,L1 +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,1,=,=,Low,L1 +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,5,=,=,Medium,L1 +2.3.11.8,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,1,>=,>=,Medium,L1 +2.3.11.9,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,1,>=,>=,Medium,L1 +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,537395200,=,=,Medium,L1 +2.3.11.11,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,537395200,=,=,Medium,L1 +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,2,=,=,Medium,L1 +2.3.11.13,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,1,>=,>=,Medium,L1 +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,1,>=,>=,Medium,L2 +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,1,=,=,Medium,L1 +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,1,=,=,Medium,L1 +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,1,=,=,Medium,L1 +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,2,=,=,Medium,L1 +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,0,=,=,Medium,L1 +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,1,=,=,Medium,L1 +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,1,=,=,Medium,L1 +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,1,=,=,Medium,L1 +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,1,=,=,Medium,L1 +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,1,=,=,Medium,L1 +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.5.1,"System Services","GameInput Service (GameInputSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\GameInputSvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.5.2,"System Services","GameInput Service (GameInputSvc) (Service Startup type)",service,GameInputSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.6.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.6.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.7.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.7.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.8.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.8.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.10.1,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"",,4,4,=|0,=|0,Medium,L1 +5.10.2,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.11.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.11.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.12.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.12.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.13.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,4,=|0,=|0,Medium,L1 +5.13.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.14.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.14.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.15.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.15.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.16.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.16.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.17.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.17.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.18.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.18.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.19.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.19.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.20.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.20.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.21.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,4,=,=,Medium,L2 +5.21.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,Disabled,=,=,Medium,L2 +5.22.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,4,=,=,Medium,L1 +5.22.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,Disabled,=,=,Medium,L1 +5.23.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.23.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.24.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.24.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.25.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,4,=|0,=|0,Medium,L2 +5.25.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L2 +5.26.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.26.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.27.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.27.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.28.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.28.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.29.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.29.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.30.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.30.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.31.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.31.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.32.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,4,=|0,=|0,Medium,L1 +5.32.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.33.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.33.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.34.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.34.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.35.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.35.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.36.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.36.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.37.1,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.37.2,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Service Startup type)",service,WinHttpAutoProxySvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.38.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.38.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.39.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.39.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.40.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.40.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.41.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.41.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.42.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.42.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,%SystemRoot%\System32\logfiles\firewall\domainfw.log,=,=,Low,L1 +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,%SystemRoot%\System32\logfiles\firewall\privatefw.log,=,=,Low,L1 +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,0,=,=,Low,L1 +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,0,=,=,Low,L1 +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,%SystemRoot%\System32\logfiles\firewall\publicfw.log,=,=,Low,L1 +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure","Success and Failure",=,=,Low,L1 +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,Failure,contains,contains,Low,L1 +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,Failure,contains,contains,Low,L1 +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,Failure,contains,contains,Low,L1 +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,"",=,=,Low,L1 +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,"",=,=,Low,L1 +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,0,=,=,Medium,L1 +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,0,=,=,Medium,L2 +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,"",=,=,Medium,L1 +18.4.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,"",=,=,Medium,L1 +18.4.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,"",=,=,Medium,L1 +18.4.4,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,L1 +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,"",=,=,Medium,L1 +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,L1 +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,"",=,=,High,L1 +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium,L1 +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2," +",=,=,Medium,L1 +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2," +",=,=,Medium,L1 +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium,L2 +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,L1 +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium,L2 +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,"",=,=,Medium,L1 +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium,L2 +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,L1 +18.5.10,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium,L1 +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,=,,Medium,L2 +18.5.12,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,=,,Medium,L2 +18.5.13,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium,L1 +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMDNS,,,,,,,0,,0,,=,,Medium,L1 +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium,L1 +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DisableIPv6DefaultDnsServers,,,,,,,0,,1,,=,,Medium,L2 +18.6.4.4,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,L1 +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,0,=,=,Medium,L2 +18.6.7.1,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.2,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.3,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.4,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium,L1 +18.6.7.5,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.7.6,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.7.7,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,>=,,Medium,L1 +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.2,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.3,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.4,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,0,=,=,Medium,L1 +18.6.8.5,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.8.6,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.8.7,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium,L2 +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,"",=,=,Medium,L1 +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,0,=,=,Medium,L1 +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,"",=,=,Medium,L1 +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1","\\*\NETLOGON;RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1",=,=,Medium,L1 +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1","\\*\SYSVOL;RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1",=,=,Medium,L1 +18.6.18.1,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (RSA key transport)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,,,TLS_RSA_,,notcontains,,Medium,L2 +18.6.18.1,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (NULL bulk encryption)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,,,_NULL_,,notcontains,,Medium,L2 +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium,L2 +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium,L2 +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium,L2 +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium,L1 +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,"",=,=,Medium,L1 +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,0,=,=,Medium,L1 +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,"",=,!=,Medium,L1 +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,"",=,=,Medium,L1 +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,0,=,=,Medium,L1 +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,0,=,=,Medium,L1 +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,5,=,=,Medium,L1 +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,0,>=,>=,Medium,L1 +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,"",=,=,Medium,L1 +18.7.8,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium,L1 +18.7.9,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0,,1,,=,,Medium,L2 +18.7.10,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,"",=,=,Medium,L1 +18.7.11,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,"",=,=,Medium,L1 +18.7.12,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,0,=,,Medium,L1 +18.7.13,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,0,=,,Medium,L1 +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,L2 +18.8.2,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0,,1,,=,,Medium,L2 +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,L1 +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,"",=,=,Medium,L1 +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,"",=,=,Medium,L1 +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,1,=,=,Medium,L1 +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,1,>=,>=,Medium,L1 +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,1,=,=,Medium,L1 +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,L1 +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,1,=,=,Medium,L1 +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,1,=,=,Medium,L1 +18.9.5.7,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium,L1 +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,"PreventInstallationOfMatchingDeviceSetupClasses;",=,=,Medium,BL +18.9.7.1.2.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,DeviceInstall_Classes_Deny_List;{d48179be-ec20-11d1-b6b8-00c04fa372a7},=,=,Medium,BL +18.9.7.1.2.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,DeviceInstall_Classes_Deny_List;{7ebefbc0-3200-11d2-b4c2-00a0C9697d07},=,=,Medium,BL +18.9.7.1.2.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,DeviceInstall_Classes_Deny_List;{c06ff265-ae09-48f0-812c-16753d7cba83},=,=,Medium,BL +18.9.7.1.2.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,DeviceInstall_Classes_Deny_List;{6bdd1fc1-810f-11d0-bec7-08002be2092f},=,=,Medium,BL +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,DeviceInstall_Classes_Deny_Retroactive;true,=,=,Medium,BL +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium,L1 +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,"",=,=,Medium,L1 +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,false,=,=,Medium,L1 +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,true,=,=,Medium,L1 +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,false,=,=,Medium,L1 +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,true,=,=,Medium,L1 +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium,L1 +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,=,Medium,L1 +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,=,Medium,L1 +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,"",=,=,Medium,L2 +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,"",=,=,Medium,L1 +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,=,Medium,L2 +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,=,Medium,L2 +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,L2 +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0," +",=,=,Medium,L2 +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,"",=,=,Medium,L2 +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,"",=,=,Medium,L2 +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,0,=,=,Medium,L2 +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,1,=,=,Medium,L2 +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,BL +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium,L1 +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium,L1 +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium,L1 +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium,L1 +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium,L1 +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium,L1 +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,=,Medium,L1 +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,1,=,=,Medium,L1 +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,=,Medium,L2 +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium,L1 +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,=,Medium,L1 +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,=,Medium,L1 +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,=,Medium,L1 +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,=,Medium,L1 +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,=,Medium,L1 +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,=,Medium,L1 +18.9.30.1,"Administrative Templates: System","Net Logon: DC Locator DNS Records: Block NetBIOS-based discovery for domain controller location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters,BlockNetbiosDiscovery,,,,,,,1,,1,,=,,Medium,L1 +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,L2 +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,L2 +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,"",=,=,Medium,BL +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,"",=,=,Medium,BL +18.9.33.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,"",=,=,Medium,L1 +18.9.33.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,"",=,=,Medium,L1 +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,"",=,=,Medium,L1 +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,L1 +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,"",=,=,Medium,L1 +18.9.39.1,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1,,1,,=,,Medium,L1 +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium,L2 +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium,L2 +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,L2 +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,L1 +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,L1 +18.9.52.1,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,0,=,=,Medium,L1 +18.10.3.1,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableAPISamping,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffAPISamping,,,,0,,1,,=,,Medium,L2 +18.10.3.2,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableApplicationFootprint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffApplicationFootprint,,,,0,,1,,=,,Medium,L2 +18.10.3.3,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInstallTracing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffInstallTracing,,,,0,,1,,=,,Medium,L2 +18.10.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,L2 +18.10.4.2,"Administrative Templates: Windows Components","App Package Deployment: Not allow per-user unsigned packages to install by default (requires explicitly allow per install)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,DisablePerUserUnsignedPackagesByDefault,,,,,,,0,,1,,=,,Medium,L1 +18.10.4.3,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium,L1 +18.10.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,2,=,=,Medium,L1 +18.10.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,"",=,=,Medium,L1 +18.10.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium,L2 +18.10.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,"",=,=,Medium,L1 +18.10.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,"",=,,Medium,L1 +18.10.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,"",=,,Medium,L1 +18.10.9.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,L1 +18.10.10.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.10.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium,BL +18.10.10.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.10.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.10.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.10.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.10.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium,BL +18.10.10.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium,BL +18.10.10.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium,BL +18.10.10.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium,BL +18.10.10.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium,BL +18.10.10.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.10.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.10.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,BL +18.10.10.2.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.10.2.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,BL +18.10.10.2.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium,BL +18.10.10.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.10.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium,BL +18.10.10.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium,BL +18.10.10.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,"",=,=,Medium,BL +18.10.10.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium,BL +18.10.11.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium,L2 +18.10.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,L1 +18.10.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium,L2 +18.10.13.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,L1 +18.10.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium,L1 +18.10.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,L1 +18.10.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,"",=,=,Medium,L1 +18.10.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium,L1 +18.10.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,L1 +18.10.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium,L2 +18.10.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium,L1 +18.10.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,L1 +18.10.16.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium,L1 +18.10.16.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,L1 +18.10.16.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,L1 +18.10.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium,L1 +18.10.18.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium,L2 +18.10.18.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium,L1 +18.10.18.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium,L1 +18.10.18.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableLocalArchiveMalwareScanOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableLocalArchiveMalwareScanOverride,,,,,,0,,=,,Medium,L1 +18.10.18.5,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableBypassCertificatePinningForMicrosoftStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableBypassCertificatePinningForMicrosoftStore,,,,,,0,,=,,Medium,L1 +18.10.18.6,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium,L1 +18.10.18.7,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,,,,1,,0,,=,,Medium,L2 +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium,L1 +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium,L1 +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,196608,>=,>=,Medium,L1 +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium,L1 +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium,L1 +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium,L2 +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,"",=,=,Medium,L1 +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium,L1 +18.10.29.5,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,"",=,=,Medium,L1 +18.10.29.6,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium,L1 +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,L2 +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium,L2 +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium,L1 +18.10.43.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium,L1 +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium,L1 +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium,L2 +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,1,=,=,Medium,L1 +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium,L1 +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium,L1 +18.10.43.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium,L2 +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium,L1 +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium,L1 +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,0,=,=,Medium,L1 +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,1,=,=,Medium,L1 +18.10.43.10.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,1,=,=,Medium,L1 +18.10.43.11.1.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Brute-Force Protection aggressiveness",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionAggressiveness,,,,0,0,1,,>=,,Medium,L2 +18.10.43.11.1.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Remote Encryption Protection Mode",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionConfiguredState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionConfiguredState,,,,,0,1,,>=,,Medium,L1 +18.10.43.11.1.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Remote Encryption Protection: Configure how aggressively Remote Encryption Protection blocks threats",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection",RemoteEncryptionProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RemoteEncryptionProtectionAggressiveness,,,,0,0,1,,>=,,Medium,L2 +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium,L2 +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium,L1 +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,=,Medium,L1 +18.10.43.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.13.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Trigger a quick scan after X days without any scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DaysUntilAggressiveCatchupQuickScan,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DaysUntilAggressiveCatchupQuickScan,,,,,30,7,,=,,Medium,L1 +18.10.43.13.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,1,=,=,Medium,L1 +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium,L1 +18.10.44.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium,L1 +18.10.44.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium,L1 +18.10.44.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium,L1 +18.10.44.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium,L1 +18.10.44.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium,L1 +18.10.44.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium,L1 +18.10.50.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium,L2 +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,L1 +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium,L2 +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium,L2 +18.10.57.2.3,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium,L2 +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.8,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,,,0,,=,,Medium,L2 +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium,L1 +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,"",=,=,Medium,L1 +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium,L2 +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium,L2 +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium,L1 +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,"",=,=,Medium,L1 +18.10.58.2,"Administrative Templates: Windows Components","RSS Feeds: Turn on Basic feed authentication over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",AllowBasicAuthInClear,,,,,,,0,,0,,=,,Medium,L1 +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,L2 +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium,L1 +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium,L1 +18.10.59.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,0,=,=,Medium,L1 +18.10.59.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium,L1 +18.10.59.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium,L2 +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium,L2 +18.10.66.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium,L2 +18.10.66.2,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium,L1 +18.10.66.3,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium,L1 +18.10.66.4,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium,L2 +18.10.72.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium,L1 +18.10.76.1.1,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Automatic Data Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,CaptureThreatWindow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,AutomaticDataCollection,,,,,,1,1,=,=,Medium,L1 +18.10.76.1.2,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,1,=,=,Medium,L1 +18.10.76.1.3,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,1,=,=,Medium,L1 +18.10.76.1.4,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,1,=,=,Medium,L1 +18.10.76.1.5,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,1,=,=,Medium,L1 +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,1,=,=,Medium,L1 +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,0,=,=,Medium,L1 +18.10.78.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium,L1 +18.10.79.1,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",Registry,,HKLM:\SOFTWARE\Microsoft\Policies\PassportForWork\Biometrics,EnableESSwithSupportedPeripherals,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\PassportForWork,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\PassportForWork,EnableESSwithSupportedPeripherals,,,,,,1,,=,,Medium,L1 +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium,L2 +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,1,<=,<=,Medium,L1 +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,0,=,=,Medium,L1 +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,0,=,=,Medium,L1 +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,L2 +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,=,Medium,L1 +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,=,Medium,L1 +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,"",=,=,Medium,L2 +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium,L2 +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,"",=,=,Medium,L1 +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,"",=,=,Medium,L1 +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,"",=,=,Medium,L1 +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,"",=,=,Medium,L1 +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,L2 +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,"",=,=,Medium,L1 +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,"",=,=,Medium,L1 +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,L2 +18.10.91.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium,L1 +18.10.91.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow mapping folders into Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowWriteToMappedFolders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowWriteToMappedFolders,,,,1,,0,,=,,Medium,L2 +18.10.91.3,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium,L1 +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium,L1 +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium,L1 +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium,L1 +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium,L1 +18.10.93.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium,L1 +18.10.93.2.4,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Enable features introduced via servicing that are off by default",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,AllowTemporaryEnterpriseFeatureControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowTemporaryEnterpriseFeatureControl,,,,,,0,,=,,Medium,L1 +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium,L1 +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium,L1 +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium,L1 +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low,L1 +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium,L1 +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium,L1 +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium,L1 +18.10.93.4.4,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Enable optional updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetAllowOptionalContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowOptionalContent,,,,,,0,,=,,Medium,L1 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv new file mode 100644 index 0000000..96aaf84 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv @@ -0,0 +1,14 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,L1 +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,L2 +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium,L1 +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium,L1 +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium,L1 +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,L1 +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,L2 +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium,L2 +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium,L1 +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium,L1 +19.7.40.1,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot,TurnOffWindowsCopilot,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI,TurnOffWindowsCopilot,,,,0,,1,,=,,Medium,L1 +19.7.44.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +19.7.46.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium,L2 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv new file mode 100644 index 0000000..c73b078 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv @@ -0,0 +1,594 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,24,>=,>=,Low,L1 +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,365,<=!0,<=!0,Low,L1 +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,1,>=,>=,Low,L1 +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,14,>=,>=,Medium,L1 +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,1,=,=,Medium,L1 +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,1,=,=,Medium,L1 +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,0,=,=,High,L1 +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,15,>=,>=,Low,L1 +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,5,<=!0,<=!0,Low,L1 +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,1,=,=,Medium,L1 +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,15,>=,>=,Low,L1 +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.2,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators","BUILTIN\Remote Desktop Users;BUILTIN\Administrators",=,=,Medium,L1 +2.2.3,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.4,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.5,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,BUILTIN\Users;BUILTIN\Administrators,=,=,Medium,L1 +2.2.6,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators","BUILTIN\Remote Desktop Users;BUILTIN\Administrators",=,=,Medium,L1 +2.2.7,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.8,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE","BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.9,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.10,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.11,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.12,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.13.1,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.13.2,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators","NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",=,=,Medium,L1 +2.2.14,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.15,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account","BUILTIN\Guests;NT AUTHORITY\Local account",=,=,Medium,L1 +2.2.16,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.17,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.18,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,BUILTIN\Guests,=,=,Medium,L1 +2.2.19,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account","BUILTIN\Guests;NT AUTHORITY\Local account",=,=,Medium,L1 +2.2.20,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.21,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.22,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService","NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",=,=,Medium,L1 +2.2.23,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService","NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",=,=,Medium,L1 +2.2.24,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators","Window Manager\Window Manager Group;BUILTIN\Administrators",=,=,Medium,L1 +2.2.25,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.26,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.27,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L2 +2.2.28.1,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,,,=,=,Medium,L2 +2.2.28.2,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,"NT VIRTUAL MACHINE\Virtual Machines","NT VIRTUAL MACHINE\Virtual Machines",=,=,Medium,L2 +2.2.28.3,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE",,WDAGUtilityAccount,WDAGUtilityAccount,=,=,Medium,L2 +2.2.29,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.30,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,=,Medium,L1 +2.2.31,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.32,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.33,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.34,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators","NT SERVICE\WdiServiceHost;BUILTIN\Administrators",=,=,Medium,L1 +2.2.35,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE","NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",=,=,Medium,L1 +2.2.36,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.2.37,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Users;BUILTIN\Administrators,BUILTIN\Users;BUILTIN\Administrators,=,=,Medium,L1 +2.2.38,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,BUILTIN\Administrators,=,=,Medium,L1 +2.3.1.1,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,False,=,=,Medium,L1 +2.3.1.2,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,1,=,=,Medium,L1 +2.3.1.3,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,Administrator,!=,!=,Low,L1 +2.3.1.4,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,Guest,!=,!=,Low,L1 +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,1,=,=,Low,L1 +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,0,=,=,Low,L1 +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,1,=,=,Medium,L2 +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,1,=,=,Medium,L1 +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,1,=,=,Medium,L1 +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,1,=,=,Medium,L1 +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,0,=,=,Medium,L1 +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,30,<=!0,<=!0,Medium,L1 +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,1,=,=,Medium,L1 +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,0,=,=,Low,L2 +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,1,=,=,Low,L1 +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,900,<=!0,<=!0,Medium,L1 +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,!=,Low,L1 +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,!=,Low,L1 +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,4,<=,<=,Medium,L2 +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,14,<=,<=,Low,L1 +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,5,>=,>=,Low,L1 +2.3.7.8,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,1,=,=,Low,L1 +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,1,=,=,Medium,L1 +2.3.8.2,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,0,=,=,Medium,L1 +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,15,<=,<=,Medium,L1 +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,1,=,=,Medium,L1 +2.3.9.3,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,1,=,=,Medium,L1 +2.3.9.4,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,,,1,1,>=,>=,Medium,L1 +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,0,=,=,Medium,L1 +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,1,=,=,Medium,L1 +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,1,=,=,Medium,L1 +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,1,=,=,Medium,L1 +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,0,=,=,Medium,L1 +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,=,Medium,L1 +2.3.10.7,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion","System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",=,=,Medium,L1 +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog","System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",=,=,Medium,L1 +2.3.10.9,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,1,=,=,Medium,L1 +2.3.10.10,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),O:BAG:BAD:(A;;RC;;;BA),=,=,Medium,L1 +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,=,Medium,L1 +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,0,=,=,Medium,L1 +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,1,=,=,Medium,L1 +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,0,=,=,Medium,L1 +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,0,=,=,Medium,L1 +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,2147483640,<=,<=,Medium,L1 +2.3.11.5,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,1,=,=,Low,L1 +2.3.11.6,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,5,=,=,Medium,L1 +2.3.11.7,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,1,>=,>=,Medium,L1 +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,1,>=,>=,Medium,L1 +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,537395200,=,=,Medium,L1 +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,537395200,=,=,Medium,L1 +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,2,=,=,Medium,L1 +2.3.11.12,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,1,>=,>=,Medium,L1 +2.3.14.1,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,1,>=,>=,Medium,L2 +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,1,=,=,Medium,L1 +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,1,=,=,Medium,L1 +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,1,=,=,Medium,L1 +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,2,=,=,Medium,L1 +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,0,=,=,Medium,L1 +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,1,=,=,Medium,L1 +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,1,=,=,Medium,L1 +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,1,=,=,Medium,L1 +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,1,=,=,Medium,L1 +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,1,=,=,Medium,L1 +5.1.1,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.1.2,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.2.1,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.2.2,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.3.1,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.3.2,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.4.1,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.4.2,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.5.1,"System Services","GameInput Service (GameInputSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\GameInputSvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.5.2,"System Services","GameInput Service (GameInputSvc) (Service Startup type)",service,GameInputSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.6.1,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.6.2,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.7.1,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.7.2,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.8.1,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.8.2,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.9.1,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.9.2,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.10.1,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.10.2,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.11.1,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.11.2,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.12.1,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,,,4,4,=|0,=|0,Medium,L1 +5.12.2,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.13.1,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3,,4,4,=|0,=|0,Medium,L2 +5.13.2,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L2 +5.14.1,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3,,4,4,=|0,=|0,Medium,L2 +5.14.2,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L2 +5.15.1,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3,,4,4,=|0,=|0,Medium,L2 +5.15.2,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L2 +5.16.1,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3,,4,4,=|0,=|0,Medium,L2 +5.16.2,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L2 +5.17.1,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.17.2,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.18.1,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.18.2,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.19.1,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.19.2,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.20.1,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.20.2,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.21.1,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.21.2,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.22.1,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.22.2,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.23.1,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.23.2,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.24.1,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4,,4,4,=,=,Medium,L2 +5.24.2,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled,,Disabled,Disabled,=,=,Medium,L2 +5.25.1,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4,,4,4,=,=,Medium,L1 +5.25.2,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled,,Disabled,Disabled,=,=,Medium,L1 +5.26.1,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.26.2,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.27.1,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.27.2,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.28.1,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,,,4,4,=|0,=|0,Medium,L2 +5.28.2,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L2 +5.29.1,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.29.2,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.30.1,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.30.2,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.31.1,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.31.2,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.32.1,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.32.2,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"",,Disabled,Disabled,=|0,=|0,Medium,L1 +5.33.1,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.33.2,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.34.1,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.34.2,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.35.1,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3,,4,4,=|0,=|0,Medium,L1 +5.35.2,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.36.1,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.36.2,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.37.1,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2,,4,4,=,=,Medium,L2 +5.37.2,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic,,Disabled,Disabled,=,=,Medium,L2 +5.38.1,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.38.2,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.39.1,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3,,4,4,=,=,Medium,L2 +5.39.2,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L2 +5.40.1,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,,,4,4,=|0,=|0,Medium,L1 +5.40.2,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,,,Disabled,Disabled,=|0,=|0,Medium,L1 +5.41.1,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.41.2,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.42.1,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.42.2,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.43.1,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.43.2,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +5.44.1,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,4,=,=,Medium,L1 +5.44.2,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,Disabled,=,=,Medium,L1 +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,,,!=,!=,Low,L1 +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,,,!=,!=,Low,L1 +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,1,=,=,Medium,L1 +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,1,=,=,Medium,L1 +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,1,=,=,Low,L1 +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,0,=,=,Low,L1 +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,0,=,=,Low,L1 +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,,,!=,!=,Low,L1 +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,16384,>=,>=,Medium,L1 +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,1,=,=,Medium,L1 +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,1,=,=,Low,L1 +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.2.2,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.2.3,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure","Success and Failure",=,=,Low,L1 +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,Failure,contains,contains,Low,L1 +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,Failure,contains,contains,Low,L1 +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,Failure,contains,contains,Low,L1 +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,=,=,Low,L1 +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,Success,contains,contains,Low,L1 +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,Success,contains,contains,Low,L1 +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure","Success and Failure",=,=,Low,L1 +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,"",=,=,Low,L1 +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,"",=,=,Low,L1 +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,0,=,=,Medium,L1 +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,0,=,=,Medium,L2 +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,"",=,=,Medium,L1 +18.4.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,"",=,=,Medium,L1 +18.4.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,"",=,=,Medium,L1 +18.4.4,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,L1 +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,"",=,=,Medium,L1 +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,L1 +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,"",=,=,High,L1 +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium,L1 +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2," +",=,=,Medium,L1 +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2," +",=,=,Medium,L1 +18.5.4,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,,,1,,=,,Medium,L2 +18.5.5,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,L1 +18.5.6,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium,L2 +18.5.7,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,"",=,=,Medium,L1 +18.5.8,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium,L2 +18.5.9,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,L1 +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,=,,Medium,L2 +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,=,,Medium,L2 +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium,L1 +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMDNS,,,,,,,0,,0,,=,,Medium,L1 +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium,L1 +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DisableIPv6DefaultDnsServers,,,,,,,0,,1,,=,,Medium,L2 +18.6.4.4,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,L1 +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,0,=,=,Medium,L2 +18.6.7.1,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.2,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.3,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.4,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium,L1 +18.6.7.5,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.7.6,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.7.7,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,>=,,Medium,L1 +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.2,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.3,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.4,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,0,=,=,Medium,L1 +18.6.8.5,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.8.6,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.8.7,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,"",=,=,Medium,L2 +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium,L2 +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,"",=,=,Medium,L1 +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,0,=,=,Medium,L1 +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,"",=,=,Medium,L1 +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1","\\*\NETLOGON;RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1",=,=,Medium,L1 +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1","\\*\SYSVOL;RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1",=,=,Medium,L1 +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium,L2 +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium,L2 +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium,L2 +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium,L1 +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,"",=,=,Medium,L1 +18.6.23.2.1,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,0,=,=,Medium,L1 +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,"",=,!=,Medium,L1 +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,"",=,=,Medium,L1 +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,0,=,=,Medium,L1 +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,0,=,=,Medium,L1 +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,5,=,=,Medium,L1 +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,0,>=,>=,Medium,L1 +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,"",=,=,Medium,L1 +18.7.8,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium,L1 +18.7.9,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0,,1,,=,,Medium,L2 +18.7.10,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,"",=,=,Medium,L1 +18.7.11,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,"",=,=,Medium,L1 +18.7.12,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,0,=,,Medium,L1 +18.7.13,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,0,=,,Medium,L1 +18.7.14,"Administrative Templates: Printers","Require IPPS for IPP printers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",RequireIpps,,,,,,,,,1,,=,,Medium,L2 +18.7.15,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockUnknownCA,,,,,,,,,1,,=,,Medium,L2 +18.7.16,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow non-server certificates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertWrongUsage,,,,,,,,,1,,=,,Medium,L2 +18.7.17,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertCNInvalid,,,,,,,,,1,,=,,Medium,L2 +18.7.18,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertDateInvalid,,,,,,,,,1,,=,,Medium,L2 +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,L2 +18.8.2,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0,,1,,=,,Medium,L2 +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,L1 +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,"",=,=,Medium,L1 +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,"",=,=,Medium,L1 +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,1,=,=,Medium,L1 +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,1,>=,>=,Medium,L1 +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,1,=,=,Medium,L1 +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,L1 +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,1,=,=,Medium,L1 +18.9.5.6,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,1,=,=,Medium,L1 +18.9.5.7,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium,L1 +18.9.7.1.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,"PreventInstallationOfMatchingDeviceSetupClasses;",=,=,Medium,BL +18.9.7.1.2.1,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,DeviceInstall_Classes_Deny_List;{d48179be-ec20-11d1-b6b8-00c04fa372a7},=,=,Medium,BL +18.9.7.1.2.2,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,DeviceInstall_Classes_Deny_List;{7ebefbc0-3200-11d2-b4c2-00a0C9697d07},=,=,Medium,BL +18.9.7.1.2.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,c06ff265-ae09-48f0-812c-16753d7cba83,DeviceInstall_Classes_Deny_List;{c06ff265-ae09-48f0-812c-16753d7cba83},=,=,Medium,BL +18.9.7.1.2.4,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,6bdd1fc1-810f-11d0-bec7-08002be2092f,DeviceInstall_Classes_Deny_List;{6bdd1fc1-810f-11d0-bec7-08002be2092f},=,=,Medium,BL +18.9.7.1.3,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,DeviceInstall_Classes_Deny_Retroactive;true,=,=,Medium,BL +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium,L1 +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,"",=,=,Medium,L1 +18.9.17.1,"Administrative Templates: System","Filesystem: Enable / disable CLFS logfile authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Policies,ClfsAuthenticationChecking,,,,,,,,,1,,=,,Medium,L1 +18.9.19.2,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,false,=,=,Medium,L1 +18.9.19.3,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,true,=,=,Medium,L1 +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium,L1 +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,=,Medium,L1 +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,=,Medium,L1 +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,"",=,=,Medium,L2 +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,"",=,=,Medium,L1 +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,=,Medium,L2 +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,=,Medium,L2 +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,L2 +18.9.20.1.13,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0," +",=,=,Medium,L2 +18.9.20.1.14.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,"",=,=,Medium,L2 +18.9.20.1.14.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,"",=,=,Medium,L2 +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,0,=,=,Medium,L2 +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,1,=,=,Medium,L2 +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,BL +18.9.26.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium,L1 +18.9.26.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium,L1 +18.9.26.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium,L1 +18.9.26.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,>=,,Medium,L1 +18.9.26.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium,L1 +18.9.26.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium,L1 +18.9.26.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium,L1 +18.9.26.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium,L1 +18.9.27.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,=,Medium,L1 +18.9.27.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,1,=,=,Medium,L1 +18.9.28.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,=,Medium,L2 +18.9.29.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium,L1 +18.9.29.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,=,Medium,L1 +18.9.29.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,=,Medium,L1 +18.9.29.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,=,Medium,L1 +18.9.29.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,=,Medium,L1 +18.9.29.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,=,Medium,L1 +18.9.29.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,=,Medium,L1 +18.9.31.1.1,"Administrative Templates: System","Net Logon: DC Locator DNS Records: Block NetBIOS-based discovery for domain controller location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters,BlockNetbiosDiscovery,,,,,,,1,,1,,=,,Medium,L1 +18.9.33.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,L2 +18.9.33.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,L2 +18.9.35.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.35.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium,L1 +18.9.35.6.3,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,"",=,=,Medium,BL +18.9.35.6.4,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,"",=,=,Medium,BL +18.9.35.6.5,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,"",=,=,Medium,L1 +18.9.35.6.6,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,"",=,=,Medium,L1 +18.9.37.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.37.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,"",=,=,Medium,L1 +18.9.38.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,L1 +18.9.38.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,"",=,=,Medium,L1 +18.9.41.1,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1,,1,,=,,Medium,L1 +18.9.49.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium,L2 +18.9.49.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium,L2 +18.9.51.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,L2 +18.9.53.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,L1 +18.9.53.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,L1 +18.9.54,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,0,=,=,Medium,L1 +18.10.3.1,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableAPISamping,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffAPISamping,,,,0,,1,,=,,Medium,L2 +18.10.3.2,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableApplicationFootprint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffApplicationFootprint,,,,0,,1,,=,,Medium,L2 +18.10.3.3,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInstallTracing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffInstallTracing,,,,0,,1,,=,,Medium,L2 +18.10.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,L2 +18.10.4.2,"Administrative Templates: Windows Components","App Package Deployment: Not allow per-user unsigned packages to install by default (requires explicitly allow per install)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,DisablePerUserUnsignedPackagesByDefault,,,,,,,0,,1,,=,,Medium,L1 +18.10.4.3,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0,,1,,=,,Medium,L1 +18.10.5.1,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,2,=,=,Medium,L1 +18.10.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,"",=,=,Medium,L1 +18.10.6.2,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium,L2 +18.10.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,"",=,=,Medium,L1 +18.10.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,"",=,,Medium,L1 +18.10.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,"",=,,Medium,L1 +18.10.9.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,L1 +18.10.10.1.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.10.1.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.1.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1,,1,,=,,Medium,BL +18.10.10.1.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.10.1.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,2,,=,,Medium,BL +18.10.10.1.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.1.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.10.1.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.1.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,,,0,,=,,Medium,BL +18.10.10.1.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,,,0,,=,,Medium,BL +18.10.10.1.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0,,0,,=,,Medium,BL +18.10.10.1.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.1.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0,,1,,=,,Medium,BL +18.10.10.2.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium,BL +18.10.10.2.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium,BL +18.10.10.2.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.10.2.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,,,1,,=,,Medium,BL +18.10.10.2.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1,,0,,=,,Medium,BL +18.10.10.2.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0,,1,,=,,Medium,BL +18.10.10.2.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,BL +18.10.10.3.1,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,,,,,=,,Medium,BL +18.10.10.3.2,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0,,1,,=,,Medium,BL +18.10.10.3.3,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.4,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.5,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.6,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.7,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.8,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.9,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.10,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.11,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,,,0,,=,,Medium,BL +18.10.10.3.12,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.13,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,,,1,,=,,Medium,BL +18.10.10.3.14,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium,BL +18.10.10.3.15,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,"",=,=,Medium,BL +18.10.11.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium,L2 +18.10.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,L1 +18.10.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium,L2 +18.10.13.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,L1 +18.10.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium,L1 +18.10.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,L1 +18.10.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,"",=,=,Medium,L1 +18.10.15.3,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium,L1 +18.10.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,L1 +18.10.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium,L2 +18.10.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,L1 +18.10.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium,L2 +18.10.16.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,L2 +18.10.16.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,L2 +18.10.17.1,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,3,,!=,,Medium,L1 +18.10.18.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium,L2 +18.10.18.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium,L1 +18.10.18.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium,L1 +18.10.18.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableLocalArchiveMalwareScanOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableLocalArchiveMalwareScanOverride,,,,,,0,,=,,Medium,L1 +18.10.18.5,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableBypassCertificatePinningForMicrosoftStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableBypassCertificatePinningForMicrosoftStore,,,,,,0,,=,,Medium,L1 +18.10.18.6,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium,L1 +18.10.18.7,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,,,,1,,0,,=,,Medium,L2 +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium,L1 +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium,L1 +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,196608,>=,>=,Medium,L1 +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium,L1 +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium,L1 +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,32768,>=,>=,Medium,L1 +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium,L1 +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium,L2 +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,"",=,=,Medium,L1 +18.10.29.5,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,"",=,=,Medium,L1 +18.10.29.6,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium,L1 +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,L2 +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium,L2 +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium,L1 +18.10.43.1,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,,,1,,=,,Medium,L1 +18.10.43.2,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,,,0,,=,,Medium,L1 +18.10.43.3,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,,,0,,=,,Medium,L1 +18.10.43.4,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,,,0,,=,,Medium,L1 +18.10.43.5,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,,,1,,=,,Medium,L1 +18.10.43.6,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,,,1,,=,,Medium,L1 +18.10.49.1,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,,,0,,=,,Medium,L2 +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,L2 +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium,L2 +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium,L2 +18.10.57.2.3,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium,L2 +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.8,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,,,0,,=,,Medium,L2 +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,"",=,=,Medium,L1 +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium,L1 +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,"",=,=,Medium,L1 +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium,L1 +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium,L1 +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,"",=,=,Medium,L1 +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,L2 +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium,L1 +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium,L1 +18.10.59.5,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,0,=,=,Medium,L1 +18.10.59.6,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium,L1 +18.10.59.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium,L2 +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium,L2 +18.10.66.1,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,,,1,,=,,Medium,L2 +18.10.66.2,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,,,4,,=,,Medium,L1 +18.10.66.3,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,,,1,,=,,Medium,L1 +18.10.66.4,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,,,1,,=,,Medium,L2 +18.10.72.1,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,,,0,,=,,Medium,L2 +18.10.73.1,"Administrative Templates: Windows Components","Windows AI: Allow Recall to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WindowsAI,AllowRecallEnablement,,,,,,,,,0,,=,"",Medium,L1 +18.10.77.1.1,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Automatic Data Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,CaptureThreatWindow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,AutomaticDataCollection,,,,,,1,1,=,=,Medium,L1 +18.10.77.1.2,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,1,=,=,Medium,L1 +18.10.77.1.3,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,1,=,=,Medium,L1 +18.10.77.1.4,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,1,=,=,Medium,L1 +18.10.77.1.5,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,1,=,=,Medium,L1 +18.10.77.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,1,=,=,Medium,L1 +18.10.77.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,0,=,=,Medium,L1 +18.10.79.1,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium,L1 +18.10.80.1,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",Registry,,HKLM:\SOFTWARE\Microsoft\Policies\PassportForWork\Biometrics,EnableESSwithSupportedPeripherals,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\PassportForWork,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\PassportForWork,EnableESSwithSupportedPeripherals,,,,,,1,,=,,Medium,L1 +18.10.81.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium,L2 +18.10.81.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,1,<=,<=,Medium,L1 +18.10.82.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,0,=,=,Medium,L1 +18.10.82.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,0,=,=,Medium,L1 +18.10.82.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,L2 +18.10.83.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,=,Medium,L1 +18.10.83.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,=,Medium,L1 +18.10.88.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,"",=,=,Medium,L2 +18.10.88.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium,L2 +18.10.90.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,"",=,=,Medium,L1 +18.10.90.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,"",=,=,Medium,L1 +18.10.90.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,"",=,=,Medium,L1 +18.10.90.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,"",=,=,Medium,L1 +18.10.90.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,L2 +18.10.90.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,"",=,=,Medium,L1 +18.10.90.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,"",=,=,Medium,L1 +18.10.91.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,L2 +18.10.92.1,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,,,0,,=,,Medium,L1 +18.10.92.2,"Administrative Templates: Windows Components","Windows Sandbox: Allow mapping folders into Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowWriteToMappedFolders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowWriteToMappedFolders,,,,1,,0,,=,,Medium,L2 +18.10.92.3,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,,,0,,=,,Medium,L1 +18.10.93.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium,L1 +18.10.94.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium,L1 +18.10.94.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium,L1 +18.10.94.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium,L1 +18.10.94.2.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Enable features introduced via servicing that are off by default",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,AllowTemporaryEnterpriseFeatureControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowTemporaryEnterpriseFeatureControl,,,,,,0,,=,,Medium,L1 +18.10.94.2.4,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,,,1,,=,,Medium,L1 +18.10.94.4.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Enable optional updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetAllowOptionalContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowOptionalContent,,,,,,0,,=,,Medium,L1 +18.10.94.4.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium,L1 +18.10.94.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium,L1 +18.10.94.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium,L1 +18.11.1,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable WPAD",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp",DisableWpad,,,,,,,,,1,,=,,Medium,L1 +18.11.2,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable proxy authentication",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",DisableProxyAuthenticationSchemes,,,,,,,,,256,,>=,,Medium,L1 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv new file mode 100644 index 0000000..c04454d --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv @@ -0,0 +1,12 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,L1 +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,L2 +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium,L1 +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium,L1 +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium,L1 +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,L1 +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,L2 +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium,L2 +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium,L1 +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium,L1 +19.7.46.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium,L2 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv new file mode 100644 index 0000000..52d9911 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv @@ -0,0 +1,358 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.12,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.4,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Extended Protection for LDAP Authentication (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.1,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.1,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.24.2.1,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (AntiDetours)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,AntiDetours,,,,,,,,,1,,=,,Medium, +18.9.24.2.2,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (BannedFunctions)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,BannedFunctions,,,,,,,,,1,,=,,Medium, +18.9.24.2.3,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (DeepHooks)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DeepHooks,,,,,,,,,1,,=,,Medium, +18.9.24.2.4,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (ExploitAction)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ExploitAction,,,,,,,,,1,,=,,Medium, +18.9.24.3,"Administrative Templates: Windows Components","EMET: Default Protections for Internet Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,IE,,,,,,,,,"*\Internet Explorer\iexplore.exe",,=,,Medium, +18.9.24.4,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Popular Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for all installed and popular software*",,=,,Medium, +18.9.24.5,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Recommended Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for installed software like Adobe Acrobat*",,=,,Medium, +18.9.24.6,"Administrative Templates: Windows Components","EMET: System ASLR",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ASLR,,,,,,,,,3,,=,,Medium, +18.9.24.7,"Administrative Templates: Windows Components","EMET: System DEP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DEP,,,,,,,,,2,,=,,Medium, +18.9.24.8,"Administrative Templates: Windows Components","EMET: System SEHOP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,SEHOP,,,,,,,,,2,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.39.1.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off Windows Location Provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableWindowsLocationProvider,,,,,,,0,,1,,=,,Medium, +18.9.39.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.52.2,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage on Windows 8.1",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSync,,,,,,,0,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.13.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.81.2.1,"Administrative Templates: Windows Components","Windows Error Reporting: Consent: Configure Default consent",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent",DefaultConsent,,,,,,,0,,3,,=,,Medium, +18.9.81.3,"Administrative Templates: Windows Components","Windows Error Reporting: Automatically send memory dumps for OS-generated error reports",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",AutoApproveOSDumps,,,,,,,1,,0,,=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.102.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv new file mode 100644 index 0000000..0d794bf --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv @@ -0,0 +1,12 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv new file mode 100644 index 0000000..2a3738e --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv @@ -0,0 +1,372 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.4,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.5.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,1,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.6.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.6.2,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.6.3,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Always use classic logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,LogonType,,,,,,,,,0,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.8,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.40.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.8.48.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.48.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.50.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.53.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.53.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.25.2.1,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (AntiDetours)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,AntiDetours,,,,,,,,,1,,=,,Medium, +18.9.25.2.2,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (BannedFunctions)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,BannedFunctions,,,,,,,,,1,,=,,Medium, +18.9.25.2.3,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (DeepHooks)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DeepHooks,,,,,,,,,1,,=,,Medium, +18.9.25.2.4,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (ExploitAction)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ExploitAction,,,,,,,,,1,,=,,Medium, +18.9.25.3,"Administrative Templates: Windows Components","EMET: Default Protections for Internet Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,IE,,,,,,,,,"*\Internet Explorer\iexplore.exe",,=,,Medium, +18.9.25.4,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Popular Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for all installed and popular software*",,=,,Medium, +18.9.25.5,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Recommended Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for installed software like Adobe Acrobat*",,=,,Medium, +18.9.25.6,"Administrative Templates: Windows Components","EMET: System ASLR",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ASLR,,,,,,,,,3,,=,,Medium, +18.9.25.7,"Administrative Templates: Windows Components","EMET: System DEP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DEP,,,,,,,,,2,,=,,Medium, +18.9.25.8,"Administrative Templates: Windows Components","EMET: System SEHOP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,SEHOP,,,,,,,,,2,,=,,Medium, +18.9.27.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.27.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.27.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.27.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.27.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.27.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.27.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.27.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.31.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.31.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.31.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.41.1.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off Windows Location Provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableWindowsLocationProvider,,,,,,,0,,1,,=,,Medium, +18.9.41.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.47.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.47.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.47.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.47.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.47.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.47.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.47.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,1,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.58.2,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage on Windows 8.1",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSync,,,,,,,0,,1,,=,,Medium, +18.9.65.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.65.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.65.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.65.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.65.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.65.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.65.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.65.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.65.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.65.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.65.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.67.2,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",ConnectedSearchPrivacy,,,,,,,1,,3,,=,,Medium, +18.9.67.3,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.85.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.85.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.86.2.1,"Administrative Templates: Windows Components","Windows Error Reporting: Consent: Configure Default consent",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent",DefaultConsent,,,,,,,0,,3,,=,,Medium, +18.9.86.3,"Administrative Templates: Windows Components","Windows Error Reporting: Automatically send memory dumps for OS-generated error reports",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",AutoApproveOSDumps,,,,,,,1,,0,,=,,Medium, +18.9.90.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.90.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.90.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.91.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.100.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.9.100.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.102.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.102.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.102.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.102.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.102.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.102.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.102.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.103.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.108.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.108.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.108.3,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv new file mode 100644 index 0000000..9402f3a --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv @@ -0,0 +1,11 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv new file mode 100644 index 0000000..43e08e2 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv @@ -0,0 +1,399 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.4,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.5,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,1,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.27.2,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.27.3,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.27.4,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.27.5,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.27.6,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.24.2.1,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (AntiDetours)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,AntiDetours,,,,,,,,,1,,=,,Medium, +18.10.24.2.2,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (BannedFunctions)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,BannedFunctions,,,,,,,,,1,,=,,Medium, +18.10.24.2.3,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (DeepHooks)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DeepHooks,,,,,,,,,1,,=,,Medium, +18.10.24.2.4,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (ExploitAction)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ExploitAction,,,,,,,,,1,,=,,Medium, +18.10.24.3,"Administrative Templates: Windows Components","EMET: Default Protections for Internet Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,IE,,,,,,,,,"*\Internet Explorer\iexplore.exe",,=,,Medium, +18.10.24.4,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Popular Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for all installed and popular software*",,=,,Medium, +18.10.24.5,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Recommended Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,,,"*Add entries for installed software like Adobe Acrobat*",,=,,Medium, +18.10.24.6,"Administrative Templates: Windows Components","EMET: System ASLR",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ASLR,,,,,,,,,3,,=,,Medium, +18.10.24.7,"Administrative Templates: Windows Components","EMET: System DEP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DEP,,,,,,,,,2,,=,,Medium, +18.10.24.8,"Administrative Templates: Windows Components","EMET: System SEHOP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,SEHOP,,,,,,,,,2,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.37.1.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off Windows Location Provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableWindowsLocationProvider,,,,,,,0,,1,,=,,Medium, +18.10.37.2,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,1,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.51.2,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage on Windows 8.1",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSync,,,,,,,0,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",ConnectedSearchPrivacy,,,,,,,1,,3,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.77.2.1,"Administrative Templates: Windows Components","Windows Error Reporting: Consent: Configure Default consent",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent",DefaultConsent,,,,,,,0,,3,,=,,Medium, +18.10.77.3,"Administrative Templates: Windows Components","Windows Error Reporting: Automatically send memory dumps for OS-generated error reports",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",AutoApproveOSDumps,,,,,,,1,,0,,=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv new file mode 100644 index 0000000..3c3ac1b --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv @@ -0,0 +1,11 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv new file mode 100644 index 0000000..7fb071b --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv @@ -0,0 +1,387 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.8.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.77.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv new file mode 100644 index 0000000..894a7aa --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv new file mode 100644 index 0000000..8e49351 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv @@ -0,0 +1,391 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.8.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.45.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.45.4.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.45.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.45.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.45.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.45.8.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.45.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.45.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.45.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.45.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.45.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.56.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.62.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.63.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.63.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.63.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.63.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.63.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.63.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.63.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.63.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.63.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.63.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.63.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.63.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.63.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.63.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.63.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.64.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.65.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.65.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.70.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.81.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.81.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.86.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.86.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.87.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.96.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.96.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.98.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.98.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.98.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.98.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.98.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.98.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.98.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.99.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.100.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.103.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.103.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.103.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.103.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.103.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.103.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.103.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.103.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.103.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.103.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv new file mode 100644 index 0000000..f19e6b2 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv new file mode 100644 index 0000000..7eb814b --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv @@ -0,0 +1,437 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.6,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.7,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.8,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.27.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.27.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.27.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.27.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.27.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.27.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.32.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.38.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.43.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv new file mode 100644 index 0000000..6945629 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv new file mode 100644 index 0000000..0afe8a1 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv @@ -0,0 +1,440 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;",,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.10,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.11,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.12,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.14,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.15,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.16,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.17,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.20,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.22,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.27,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.29,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.30,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.34,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.35,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.36,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.37.1,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.39,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.40,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.41,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.44,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.45,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.46,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.48,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.49,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +2.3.11.13,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.6,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.7,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.8,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.9,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.25.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.25.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.25.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.25.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.25.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.25.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.25.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.25.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.28.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.42.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.42.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.42.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.42.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.42.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.42.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.42.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.42.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +18.10.42.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.42.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.42.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.42.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.55.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.56.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.56.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.56.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.56.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.56.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.56.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.56.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.56.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.56.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.56.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.56.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.57.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.58.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.58.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.58.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.62.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.75.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.75.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.79.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.79.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.80.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.86.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.86.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.88.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.88.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.88.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.88.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.88.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.88.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.88.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.89.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.91.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.92.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.92.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.92.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.92.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.92.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.92.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.92.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.92.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.92.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv new file mode 100644 index 0000000..0f85dc9 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.42.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.44.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv new file mode 100644 index 0000000..fa1046a --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv @@ -0,0 +1,412 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Extended Protection for LDAP Authentication (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.8.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.52.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.59.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.59.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.59.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.59.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.59.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.59.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.59.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.59.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.59.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.59.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.59.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.59.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.59.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.60.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.61.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.61.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.77.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.77.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.77.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.77.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.77.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.77.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.77.13.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.77.13.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.77.13.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.77.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.77.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv new file mode 100644 index 0000000..894a7aa --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.45.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv new file mode 100644 index 0000000..050ea8a --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv @@ -0,0 +1,419 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.6,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.8.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.52.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.52.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.9.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.30.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.30.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.30.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.39.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.43.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.44.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.45.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.45.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.45.4.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.45.4.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.45.4.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.45.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.45.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.45.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.45.8.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.45.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.45.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.45.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.45.14,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.45.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.55.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.62.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.62.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.62.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.62.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.62.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.62.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.62.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.62.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.62.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.62.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.9.62.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.62.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.62.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.63.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.64.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.64.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.69.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.80.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.80.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.84.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.84.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.85.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.85.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.85.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.86.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.95.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,0,,=,,Medium, +18.9.95.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.97.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.97.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.97.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.97.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.97.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.97.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.97.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.98.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.99.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.102.1.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.102.1.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.102.1.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.102.1.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,16,,=,,Medium, +18.9.102.1.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.102.1.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.102.1.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,>=,,Medium, +18.9.102.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,>=,,Medium, +18.9.102.3,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,>=,,Medium, +18.9.102.4,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,>=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv new file mode 100644 index 0000000..f19e6b2 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,,,scrnsave.scr,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.4,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv new file mode 100644 index 0000000..64eb7a7 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv @@ -0,0 +1,450 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.27.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.27.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.27.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.27.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.27.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.27.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.30.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.30.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.32.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.38.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv new file mode 100644 index 0000000..6945629 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv new file mode 100644 index 0000000..338d793 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv @@ -0,0 +1,455 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;",,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.10,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.11,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.12,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.14,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.15,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.16,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.17,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.18,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.20,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.22,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.27,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.29,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.30,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.34,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.35,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.36,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.37,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.38.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.39,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.40,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.41,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.44,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.45,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.46,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.48,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.49,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +2.3.11.13,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.6,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.7,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +18.4.8,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.9,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium, +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium, +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium, +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium, +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium, +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium, +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium, +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.25.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.25.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.25.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.25.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.25.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.25.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.25.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.25.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.28.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.42.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.42.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.42.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.42.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.42.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.42.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.42.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.42.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +18.10.42.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.42.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.42.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.42.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.55.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.56.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.56.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.56.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.56.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.56.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.56.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.56.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.56.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=,,Medium, +18.10.56.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.56.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.56.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.57.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.58.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.58.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.58.4,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium, +18.10.62.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.75.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.75.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.79.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.79.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.80.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.86.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.86.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.88.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.88.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.88.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.88.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.88.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.88.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.88.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.89.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.91.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.92.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.92.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.92.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.92.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.92.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.92.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.92.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.92.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.92.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv new file mode 100644 index 0000000..0f85dc9 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.42.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.44.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv new file mode 100644 index 0000000..119a34d --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv @@ -0,0 +1,439 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.3,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.5,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.6,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.2.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.2.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.2.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.2.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.2.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.2.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.3.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.3.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.3.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.3.4,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.3.5,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +18.3.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.3.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.4.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.4.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.4.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.4.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.4.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.4.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.4.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.4.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.4.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.4.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.4.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.4.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.5.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.5.4.2,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.5.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.5.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.5.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.5.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.5.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.5.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.5.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.5.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.5.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.5.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.5.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.5.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.5.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.5.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.5.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.6.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.6.2,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.6.3,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.8.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.8.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.8.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.8.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.8.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,3,,=,,Medium, +18.8.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.8.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.8.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.8.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.8.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.8.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.8.14.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.8.21.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.8.21.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.8.21.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.8.21.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.8.22.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.8.22.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.8.22.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.8.22.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.8.22.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.8.22.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.8.22.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.8.22.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.8.22.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.8.22.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.8.22.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.8.22.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.8.22.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.8.25.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.8.25.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.8.26.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.8.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.8.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.8.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.8.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.8.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.8.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.8.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.8.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.8.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.8.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.8.34.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.8.34.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.8.34.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.8.36.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.36.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.8.37.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.8.37.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.8.40.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.8.48.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.8.48.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.8.50.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.8.53.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.8.53.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.9.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.9.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.9.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.9.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.9.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.9.10.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.9.12.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.9.14.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.9.14.2,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.9.15.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.9.16.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.9.16.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.9.17.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.9.17.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.9.17.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.9.17.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.9.17.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.9.17.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.9.17.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.9.17.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.9.27.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.9.27.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.9.27.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.9.27.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.9.27.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.9.27.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.9.27.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.9.27.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.9.31.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.9.31.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.9.31.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.9.41.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.9.45.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.9.46.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.9.47.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.9.47.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.9.47.5.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.9.47.5.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.9.47.5.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.9.47.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.9.47.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.9.47.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.9.47.9.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.9.47.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.9.47.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.9.47.15,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.9.47.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.9.58.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.9.64.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.9.65.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.9.65.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.9.65.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.9.65.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.9.65.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.9.65.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.9.65.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.9.65.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.9.65.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.9.65.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.9.65.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.9.65.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.9.65.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.9.65.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.9.65.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.9.66.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.9.67.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.9.67.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.9.72.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.9.85.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.9.85.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.9.89.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.9.89.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.9.90.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.9.90.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.9.90.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.9.91.1,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.9.100.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.9.100.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,0,,=,,Medium, +18.9.102.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.9.102.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.9.102.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.9.102.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.9.102.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.9.102.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.9.102.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.9.103.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.9.105.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.9.108.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.9.108.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.9.108.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.9.108.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.9.108.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.9.108.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.9.108.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.9.108.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.9.108.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.9.108.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv new file mode 100644 index 0000000..463ce08 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.28.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.43.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.47.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv new file mode 100644 index 0000000..5b10e9a --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv @@ -0,0 +1,460 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.10,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.11,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.12,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.14,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.15,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.16,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.17,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.18.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.19,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.20,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.22,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.27,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.29,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.30,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.31,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.34,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.35,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.36,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.37.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.37.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.38,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.39,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.40,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.41,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.44,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.45,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.46,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.48,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2,,0,,=,,Medium, +2.3.4.2,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.1.4,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.5,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.6,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.7,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.8,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.2.4,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.5,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.6,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.7,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.8,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +9.3.4,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.5,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.7,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.8,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.9,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.10,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.3.1,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,,,"C:\Program Files\LAPS\CSE\AdmPwd.dll",,=,,Medium, +18.3.2,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0,,1,,=,,Medium, +18.3.3,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +18.3.4,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4,,4,,=,,Medium, +18.3.5,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14,,15,,>=,,Medium, +18.3.6,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30,,30,,<=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +18.9.25.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.26.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.27.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.27.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.27.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.27.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.27.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.27.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.30.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.30.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.32.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.32.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.32.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.34.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.34.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.38.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.9.46.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.46.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.48.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.50.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.50.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.76.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv new file mode 100644 index 0000000..6945629 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv @@ -0,0 +1,16 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.1.3.1,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,,,1,,=,,Medium, +19.1.3.2,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,,,1,,=,,Medium, +19.1.3.3,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,,,900,,<=!0,,Medium, +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.4.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.4.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.7.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.7.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.7.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.7.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.25.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.40.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.42.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv new file mode 100644 index 0000000..05ec6c2 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv @@ -0,0 +1,466 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;",,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.10,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.11,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.12,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.14,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.15,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.16,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.17,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.18,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.20,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.22,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.27,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.29,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.30,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.34,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.35,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.36,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.37,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.38.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.39,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.40,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.41,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.44,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.45,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.46,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.48,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.49,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low, +2.3.1.2,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.4,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.5,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.11.11,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +2.3.11.13,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.4,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.5,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.6,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.7,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.8,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,,,2,,>=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.8,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium, +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium, +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium, +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium, +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium, +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium, +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium, +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.39.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.3.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.5.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.7.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.7.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.7.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.8.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.10.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.12.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.12.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.12.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.14.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.15.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.15.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.15.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.15.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.15.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.15.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium, +18.10.17.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.17.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.17.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.17.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.25.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.25.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.25.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.25.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.25.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.25.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.25.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.25.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.28.2,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.36.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.40.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.42.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.42.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.42.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.42.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.42.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.42.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.42.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.42.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.42.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.42.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.42.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +18.10.42.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.42.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.42.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.42.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium, +18.10.50.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.55.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.56.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.56.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.56.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.10.56.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.56.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.10.56.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.56.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium, +18.10.56.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.56.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.56.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.56.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.56.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.56.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.56.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.56.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.56.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.57.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.58.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.58.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.58.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.62.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.75.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.75.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.79.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.79.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.80.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.86.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.86.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.88.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.88.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.88.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.88.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.88.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.88.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.88.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.89.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.91.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.92.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.92.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.92.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.92.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.92.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.92.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.92.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.92.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.92.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv new file mode 100644 index 0000000..9e0c92e --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.41.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.44.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv new file mode 100644 index 0000000..882a5db --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv @@ -0,0 +1,482 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low, +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low, +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium, +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low, +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.7,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;",,=,,Medium, +2.2.8,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.10,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +2.2.11,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +2.2.12,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.13,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.14,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.15,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.16,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.17,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.18,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.19.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium, +2.2.20,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.21,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.22,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +2.2.23,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.24,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.25,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +2.2.27,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium, +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.29,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.30,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.31,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.32,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.33,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.34,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium, +2.2.35,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.36,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.37,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.38.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.38.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium, +2.2.39,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.40,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.41,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.42,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.43,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.2.44,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium, +2.2.45,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +2.2.46,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.47,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +2.2.48,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium, +2.2.49,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +2.3.1.1,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +2.3.1.2,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +2.3.1.3,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low, +2.3.1.4,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low, +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low, +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium, +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium, +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium, +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +2.3.5.5,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low, +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low, +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium, +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low, +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium, +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low, +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low, +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium, +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium, +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium, +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium, +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium, +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium, +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium, +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium, +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium, +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium, +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium, +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low, +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +2.3.11.8,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,,>=,,Medium, +2.3.11.9,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +2.3.11.11,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +2.3.11.13,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +2.3.11.14,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium, +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium, +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium, +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium, +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium, +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium, +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low, +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low, +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low, +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium, +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium, +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +18.4.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +18.4.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +18.4.4.1,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.4.2,"MS Security Guide","Enable Certificate Padding (32-bit subsystem on 64-bit OS)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium, +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium, +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium, +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium, +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium, +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium, +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium, +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium, +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium, +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMDNS,,,,,,,0,,0,,=,,Medium, +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=|0,,Medium, +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DisableIPv6DefaultDnsServers,,,,,,,0,,1,,=,,Medium, +18.6.4.4,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium, +18.6.7.1,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium, +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +18.6.8.2,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium, +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium, +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium, +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium, +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium, +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium, +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium, +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium, +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium, +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium, +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium, +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium, +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium, +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium, +18.7.8,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium, +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +18.7.9,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +18.7.10,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +18.7.11,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.7.12,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium, +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium, +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium, +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium, +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium, +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium, +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium, +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium, +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium, +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium, +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium, +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium, +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium, +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium, +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium, +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium, +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium, +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium, +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium, +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium, +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium, +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium, +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium, +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium, +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium, +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium, +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium, +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium, +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium, +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium, +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium, +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium, +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium, +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium, +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium, +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium, +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +18.9.39.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium, +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium, +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium, +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium, +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium, +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium, +18.10.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium, +18.10.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +18.10.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +18.10.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +18.10.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +18.10.9.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +18.10.11.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium, +18.10.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium, +18.10.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium, +18.10.13.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +18.10.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium, +18.10.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium, +18.10.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +18.10.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium, +18.10.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium, +18.10.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium, +18.10.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium, +18.10.16.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium, +18.10.16.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium, +18.10.16.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium, +18.10.18.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium, +18.10.18.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium, +18.10.18.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium, +18.10.18.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableLocalArchiveMalwareScanOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableLocalArchiveMalwareScanOverride,,,,,,0,,=,,Medium, +18.10.18.5,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium, +18.10.18.6,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableBypassCertificatePinningForMicrosoftStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableBypassCertificatePinningForMicrosoftStore,,,,,,0,,=,,Medium, +18.10.18.7,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,,,,1,,0,,=,,Medium, +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium, +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium, +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium, +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium, +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium, +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +18.10.29.3,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium, +18.10.29.4,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium, +18.10.29.5,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium, +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium, +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium, +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium, +18.10.43.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium, +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium, +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium, +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +18.10.43.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +18.10.43.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium, +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +18.10.43.10.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +18.10.43.11.1.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Brute-Force Protection aggressiveness",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionAggressiveness,,,,0,0,1,,>=,,Medium, +18.10.43.11.1.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Remote Encryption Protection Mode",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionConfiguredState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionConfiguredState,,,,,0,1,,>=,,, +18.10.43.11.1.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Remote Encryption Protection: Configure how aggressively Remote Encryption Protection blocks threats",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection",RemoteEncryptionProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RemoteEncryptionProtectionAggressiveness,,,,0,0,1,,>=,,, +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium, +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +18.10.43.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +18.10.43.13.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Trigger a quick scan after X days without any scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DaysUntilAggressiveCatchupQuickScan,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DaysUntilAggressiveCatchupQuickScan,,,,,30,7,,=,,Medium, +18.10.43.13.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium, +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium, +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium, +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium, +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium, +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium, +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium, +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium, +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium, +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium, +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium, +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium, +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium, +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium, +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium, +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +18.10.58.2,"Administrative Templates: Windows Components","RSS Feeds: Turn on Basic feed authentication over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",AllowBasicAuthInClear,,,,,,,0,,0,,=,,Medium, +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium, +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium, +18.10.76.1.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +18.10.76.1.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium, +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium, +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium, +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium, +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium, +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium, +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium, +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium, +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium, +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium, +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium, +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low, +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium, +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium, +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv new file mode 100644 index 0000000..93a3346 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium, +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium, +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium, +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium, +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium, +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium, +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium, +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium, +19.7.44.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +19.7.46.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv new file mode 100644 index 0000000..e73ba34 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv @@ -0,0 +1,500 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1.1.1,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low,L1 +1.1.2,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,365,,<=!0,,Low,L1 +1.1.3,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,>=,,Low,L1 +1.1.4,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium,L1 +1.1.5,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium,L1 +1.1.6,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0,1,,=,,Medium,L1 +1.1.7,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High,L1 +1.2.1,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +1.2.2,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,5,,<=!0,,Low,L1 +1.2.3,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium,L1 +1.2.4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,L1 +2.2.1,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.2,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium,L1 +2.2.3,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone",,"BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium,L1 +2.2.4,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.5,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.6,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.7,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;",,=,,Medium,L1 +2.2.8,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.9,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.10,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium,L1 +2.2.11,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.12,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.13,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.14,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.15,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.16,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.17,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.18,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.19.1,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.19.2,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators,,"NT VIRTUAL MACHINE\Virtual Machines;BUILTIN\Administrators",,=,,Medium,L1 +2.2.20,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.21,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium,L1 +2.2.22,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;NT AUTHORITY\Local account and member of Administrators group",,=,,Medium,L1 +2.2.23,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.24,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.25,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium,L1 +2.2.26,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium,L1 +2.2.27,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,=,,Medium,L1 +2.2.28,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.29,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.30,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.31,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.32,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.33,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.34,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,"Window Manager\Window Manager Group;BUILTIN\Administrators",,=,,Medium,L1 +2.2.35,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.36,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.37,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L2 +2.2.38.1,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.38.2,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,"NT AUTHORITY\EXCHANGE SERVERS;BUILTIN\Administrators",,=,,Medium,L1 +2.2.39,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.40,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.41,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.42,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.43,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.2.44,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators",,=,,Medium,L1 +2.2.45,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium,L1 +2.2.46,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.47,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium,L1 +2.2.48,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,,,,,=,,Medium,L1 +2.2.49,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium,L1 +2.3.1.1,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False,,False,,=,,Medium,L1 +2.3.1.2,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium,L1 +2.3.1.3,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,Administrator,,!=,,Low,L1 +2.3.1.4,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Guest,,!=,,Low,L1 +2.3.2.1,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low,L1 +2.3.2.2,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0,,0,,=,,Low,L1 +2.3.4.1,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium,L1 +2.3.5.1,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0,,0,,=,,Medium,L1 +2.3.5.2,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,,,,,=,,Medium,L1 +2.3.5.3,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium,L1 +2.3.5.4,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium,L1 +2.3.5.5,"Security Options","Domain controller: LDAP server signing requirements Enforcement",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerEnforceIntegrity,,,,,,,,,1,,=,,Medium,L1 +2.3.5.6,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium,L1 +2.3.6.1,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium,L1 +2.3.6.2,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.3,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium,L1 +2.3.6.4,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium,L1 +2.3.6.5,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium,L1 +2.3.6.6,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium,L1 +2.3.7.1,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low,L1 +2.3.7.2,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low,L1 +2.3.7.3,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,<=!0,,Medium,L1 +2.3.7.4,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.5,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,,,!=,,Low,L1 +2.3.7.6,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,4,,<=,,Medium,L1 +2.3.7.7.1,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,14,,<=,,Low,L1 +2.3.7.7.2,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5,,5,,>=,,Low,L1 +2.3.7.8,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0,,1,,=,,Medium,L1 +2.3.7.9,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium,L1 +2.3.8.1,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.8.2,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium,L1 +2.3.8.3,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium,L1 +2.3.9.1,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15,,15,,<=,,Medium,L1 +2.3.9.2,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,L1 +2.3.9.3,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium,L1 +2.3.9.4,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1,,1,,=,,Medium,L1 +2.3.9.5,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0,,1,,>=,,Medium,L1 +2.3.10.1,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium,L1 +2.3.10.2,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium,L1 +2.3.10.3,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium,L1 +2.3.10.4,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium,L2 +2.3.10.5,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium,L1 +2.3.10.6,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,netlogon;samr;lsarpc,,=,,Medium,L1 +2.3.10.7,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.8,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion",,"System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion",,=,,Medium,L1 +2.3.10.9,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog",,"System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Services\Eventlog;Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;Software\Microsoft\Windows NT\CurrentVersion\Perflib;System\CurrentControlSet\Services\SysmonLog",,=,,Medium,L1 +2.3.10.10,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium,L1 +2.3.10.11,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium,L1 +2.3.10.12,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,,,,,=,,Medium,L1 +2.3.10.13,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0,,0,,=,,Medium,L1 +2.3.11.1,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium,L1 +2.3.11.2,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium,L1 +2.3.11.3,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium,L1 +2.3.11.4,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,<=,,Medium,L1 +2.3.11.5,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High,L1 +2.3.11.6,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0,,1,,=,,Low,L1 +2.3.11.7,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium,L1 +2.3.11.8,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,,>=,,Medium,L1 +2.3.11.9,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium,L1 +2.3.11.10,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium,L1 +2.3.11.11,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium,L1 +2.3.11.12,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium,L1 +2.3.11.13,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium,L1 +2.3.11.14,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium,L1 +2.3.13.1,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium,L1 +2.3.15.1,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1,,1,,=,,Medium,L1 +2.3.15.2,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium,L1 +2.3.17.1,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium,L1 +2.3.17.2,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium,L1 +2.3.17.3,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium,L1 +2.3.17.4,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.5,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium,L1 +2.3.17.6,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium,L1 +2.3.17.7,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1,,1,,=,,Medium,L1 +2.3.17.8,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium,L1 +5.1.1,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium,L1 +5.1.2,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium,L1 +5.2.1,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium,L2 +5.2.2,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium,L2 +9.1.1,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.1.2,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.1.3,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.1.4,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\domainfw.log,,=,,Low,L1 +9.1.5,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.1.6,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.1.7,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.2.1,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.2.2,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.2.3,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.2.4,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\privatefw.log,,=,,Low,L1 +9.2.5,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.2.6,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.2.7,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +9.3.1,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium,L1 +9.3.2,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,L1 +9.3.3,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low,L1 +9.3.4,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.5,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low,L1 +9.3.6,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"",,%SystemRoot%\System32\logfiles\firewall\publicfw.log,,=,,Low,L1 +9.3.7,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,L1 +9.3.8,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,L1 +9.3.9,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,L1 +17.1.1,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.1.2,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,L1 +17.1.3,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,L1 +17.2.1,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.2.2,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.2.3,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low,L1 +17.2.4,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low,L1 +17.2.5,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.2.6,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,L1 +17.3.1,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.3.2,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.4.1,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low,L1 +17.4.2,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low,L1 +17.5.1,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low,L1 +17.5.2,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.5.3,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.5.4,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.5.5,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.5.6,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.6.1,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.6.2,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.3,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.6.4,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.1,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.2,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.7.3,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.7.4,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.7.5,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,L1 +17.8.1,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.1,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,L1 +17.9.2,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +17.9.3,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,L1 +17.9.4,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,L1 +17.9.5,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,L1 +18.1.1.1,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low,L1 +18.1.1.2,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low,L1 +18.1.2.2,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium,L1 +18.1.3,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium,L2 +18.4.1,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium,L1 +18.4.2,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium,L1 +18.4.3,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium,L1 +18.4.4,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,L1 +18.4.5,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium,L1 +18.4.6,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,L1 +18.4.7,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High,L1 +18.5.1,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0,,0,,=,,Medium,L1 +18.5.2,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium,L1 +18.5.3,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium,L1 +18.5.4,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,L1 +18.5.5,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000,,300000,,<=,,Medium,L2 +18.5.6,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium,L1 +18.5.7,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0,,0,,=,,Medium,L2 +18.5.8,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,L1 +18.5.9,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5,,5,,<=,,Medium,L1 +18.5.10,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5,,3,,<=,,Medium,L2 +18.5.11,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5,,3,,<=,,Medium,L2 +18.5.12,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0,,90,,<=,,Medium,L1 +18.6.4.1,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMDNS,,,,,,,0,,0,,=,,Medium,L1 +18.6.4.2,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium,L1 +18.6.4.3,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DisableIPv6DefaultDnsServers,,,,,,,0,,1,,=,,Medium,L2 +18.6.4.4,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,L1 +18.6.5.1,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1,,0,,=,,Medium,L2 +18.6.7.1,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.2,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.3,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.7.3,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium,L1 +18.6.7.5,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.7.6,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.7.7,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium,L1 +18.6.8.1,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.2,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.3,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,L1 +18.6.8.4,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium,L1 +18.6.8.5,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium,L1 +18.6.8.6,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,L1 +18.6.8.7,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium,L1 +18.6.9.1.1,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.2,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.3,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.1.4,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0,,0,,=,,Medium,L2 +18.6.9.2.1,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.2,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.3,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.9.2.4,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0,,0,,=,,Medium,L2 +18.6.10.2,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0,,1,,=,,Medium,L2 +18.6.11.2,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0,,0,,=,,Medium,L1 +18.6.11.3,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium,L1 +18.6.11.4,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0,,1,,=,,Medium,L1 +18.6.14.1.1,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium,L1 +18.6.14.1.2,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1",,=,,Medium,L1 +18.6.19.2.1,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0,,255,,=,,Medium,L2 +18.6.20.1.1,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1,,0,,=,,Medium,L2 +18.6.20.1.2,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.3,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.4,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.1.5,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1,,0,,=,,Medium,L2 +18.6.20.2,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0,,1,,=,,Medium,L2 +18.6.21.1,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1,,3,,=,,Medium,L1 +18.6.21.2,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium,L2 +18.7.1,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium,L1 +18.7.2,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium,L1 +18.7.3,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.4,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,L1 +18.7.5,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium,L1 +18.7.6,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium,L1 +18.7.7,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium,L1 +18.7.8,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium,L1 +18.7.9,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0,,1,,=,,Medium,L2 +18.7.10,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium,L1 +18.7.11,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium,L1 +18.7.12,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.7.13,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,Medium,L1 +18.8.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,L2 +18.9.3.1,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,L1 +18.9.4.1,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium,L1 +18.9.4.2,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium,L1 +18.9.5.1,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium,NG +18.9.5.2,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,>=,,Medium,NG +18.9.5.3,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium,NG +18.9.5.4,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,NG +18.9.5.5,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium,NG +18.9.5.6,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium,NG +18.9.5.7,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium,NG +18.9.7.2,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,,,1,,=,,Medium,L1 +18.9.13.1,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium,L1 +18.9.19.2,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium,L1 +18.9.19.3,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium,L1 +18.9.19.4,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium,L1 +18.9.19.5,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1,,0,,=,,Medium,L1 +18.9.19.6,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1,,0,,=,,Medium,L1 +18.9.19.7,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0,,0,,=,,Medium,L1 +18.9.20.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium,L1 +18.9.20.1.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.3,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0,,1,,=,,Medium,L2 +18.9.20.1.4,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.5,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium,L1 +18.9.20.1.6,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium,L2 +18.9.20.1.7,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0,,1,,=,,Medium,L2 +18.9.20.1.8,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0,,1,,=,,Medium,L2 +18.9.20.1.9,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.10,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0,,1,,=,,Medium,L2 +18.9.20.1.11,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,L2 +18.9.20.1.12,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium,L2 +18.9.20.1.13.1,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium,L2 +18.9.20.1.13.2,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium,L2 +18.9.23.1.1,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,0,,=,,Medium,L2 +18.9.23.1.2,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1,,1,,=,,Medium,L2 +18.9.24.1,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,L1 +18.9.25.1,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,<=!0,,Medium,L1 +18.9.25.2,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.3,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium,L1 +18.9.25.4,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,,,4,,=,,Medium,L1 +18.9.25.5,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,,,15,,>=,,Medium,L1 +18.9.25.6,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,,,30,,<=,,Medium,L1 +18.9.25.7,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,,,8,,<=!0,,Medium,L1 +18.9.25.8,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,,,3,,>=,,Medium,L1 +18.9.26.1,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium,L1 +18.9.26.2,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium,NG +18.9.27.1,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0,,1,,=,,Medium,L2 +18.9.28.1,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0,,1,,=,,Medium,L1 +18.9.28.2,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium,L1 +18.9.28.3,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0,,1,,=,,Medium,L1 +18.9.28.4,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium,L1 +18.9.28.5,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium,L1 +18.9.28.6,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0,,1,,=,,Medium,L1 +18.9.28.7,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium,L1 +18.9.30.1.1,"Administrative Templates: System","Net Logon: DC Locator DNS Records: Block NetBIOS-based discovery for domain controller location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters,BlockNetbiosDiscovery,,,,,,,1,,1,,=,,Medium,L1 +18.9.31.1,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,L2 +18.9.31.2,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,L2 +18.9.33.6.1,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1,,0,,=,,Medium,L2 +18.9.33.6.2,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1,,0,,=,,Medium,L2 +18.9.33.6.3,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium,L1 +18.9.33.6.4,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium,L1 +18.9.35.1,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.35.2,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium,L1 +18.9.36.1,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,L1 +18.9.36.2,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium,L2 +18.9.39.1,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,1,,>=,,Medium,L1 +18.9.39.2,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (DC)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1,,2,,=,,Medium,L1 +18.9.39.3,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1,,1,,=,,Medium,L1 +18.9.47.5.1,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1,,0,,=,,Medium,L2 +18.9.47.11.1,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1,,0,,=,,Medium,L2 +18.9.49.1,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,L2 +18.9.51.1.1,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,L1 +18.9.51.1.2,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,L1 +18.10.4.1,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,L2 +18.10.4.2,"Administrative Templates: Windows Components","App Package Deployment: Not allow per-user unsigned packages to install by default (requires explicitly allow per install)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,DisablePerUserUnsignedPackagesByDefault,,,,,,,0,,1,,=,,Medium,L1 +18.10.6.1,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium,L1 +18.10.8.1,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium,L1 +18.10.8.2,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium,L1 +18.10.8.3,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium,L1 +18.10.9.1.1,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,L1 +18.10.11.1,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1,,0,,=,,Medium,L2 +18.10.13.1,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,L1 +18.10.13.2,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0,,1,,=,,Medium,L2 +18.10.13.3,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,L1 +18.10.14.1,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0,,1,,>=,,Medium,L1 +18.10.15.1,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,L1 +18.10.15.2,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium,L1 +18.10.16.1,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,L1 +18.10.16.2,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0,,1,,=,,Medium,L2 +18.10.16.3,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium,L1 +18.10.16.4,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,L1 +18.10.16.5,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,,,1,,=,,Medium,L1 +18.10.16.6,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,L1 +18.10.16.7,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,L1 +18.10.16.8,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1,,0,,=,,Medium,L1 +18.10.18.1,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,,,0,,=,,Medium,L2 +18.10.18.2,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,,,0,,=,,Medium,L1 +18.10.18.3,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,,,0,,=,,Medium,L1 +18.10.18.4,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableLocalArchiveMalwareScanOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableLocalArchiveMalwareScanOverride,,,,,,0,,=,,Medium,L1 +18.10.18.5,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,,,0,,=,,Medium,L1 +18.10.18.6,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableBypassCertificatePinningForMicrosoftStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableBypassCertificatePinningForMicrosoftStore,,,,,,0,,=,,Medium,L1 +18.10.18.7,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,,,,1,,0,,=,,Medium,L2 +18.10.26.1.1,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0,,0,,=,,Medium,L1 +18.10.26.1.2,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.26.2.1,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0,,0,,=,,Medium,L1 +18.10.26.2.2,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium,L1 +18.10.26.3.1,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0,,0,,=,,Medium,L1 +18.10.26.3.2,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096,,32768,,>=,,Medium,L1 +18.10.26.4.1,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0,,0,,=,,Medium,L1 +18.10.26.4.2,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium,L1 +18.10.29.2,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium,L1 +18.10.28.3,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0,,0,,=,,Medium,L1 +18.10.28.4,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0,,0,,=,,Medium,L1 +18.10.28.5,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0,,0,,=,,Medium,L1 +18.10.37.1,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,L2 +18.10.41.1,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1,,0,,=,,Medium,L2 +18.10.42.1,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,,,1,,=,,Medium,L1 +18.10.43.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium,L1 +18.10.43.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,,,0,,=,,Medium,L1 +18.10.43.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,0,,=|0,,Medium,L2 +18.10.43.6.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.2.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.3.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.4.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.4.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.5.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.5.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.6.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.6.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.7.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.8.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.9.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.9.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.11.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.11.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.12.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,L1 +18.10.43.6.1.2.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium,L1 +18.10.43.6.3.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium,L1 +18.10.43.7.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium,L1 +18.10.43.8.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium,L2 +18.10.43.10.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium,L1 +18.10.43.10.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium,L1 +18.10.43.10.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.43.10.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium,L1 +18.10.43.10.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium,L1 +18.10.43.11.1.1.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Brute-Force Protection aggressiveness",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionAggressiveness,,,,0,0,1,,>=,,Medium,L2 +18.10.43.11.1.1.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Remote Encryption Protection Mode",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionConfiguredState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionConfiguredState,,,,,0,1,,>=,,Medium,L1 +18.10.43.11.1.2.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Remote Encryption Protection: Configure how aggressively Remote Encryption Protection blocks threats",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection",RemoteEncryptionProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RemoteEncryptionProtectionAggressiveness,,,,0,0,1,,>=,,Medium,L2 +18.10.43.12.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0,,1,,=,,Medium,L2 +18.10.43.13.1,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium,L1 +18.10.43.13.2,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium,L1 +18.10.43.13.3,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.13.4,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Trigger a quick scan after X days without any scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DaysUntilAggressiveCatchupQuickScan,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DaysUntilAggressiveCatchupQuickScan,,,,,30,7,,=,,Medium,L1 +18.10.43.13.5,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium,L1 +18.10.43.16,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,Medium,L1 +18.10.43.17,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium,L1 +18.10.51.1,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,L1 +18.10.56.1,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,,,1,,=,,Medium,L2 +18.10.57.2.2,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium,L1 +18.10.57.3.2.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1,,1,,=,,Medium,L2 +18.10.57.3.3.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,,,0,,=,,Medium,L2 +18.10.57.3.3.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium,L1 +18.10.57.3.3.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.6,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0,,1,,=,,Medium,L2 +18.10.57.3.3.7,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,,,1,,=,,Medium,L2 +18.10.57.3.3.8,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,,,0,,=,,Medium,L2 +18.10.57.3.9.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.3,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0,,2,,=,,Medium,L1 +18.10.57.3.9.4,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0,,1,,=,,Medium,L1 +18.10.57.3.9.5,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium,L1 +18.10.57.3.10.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0,,900000,,<=!0,,Medium,L2 +18.10.57.3.10.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0,,60000,,=,,Medium,L2 +18.10.57.3.11.1,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1,,1,,=,,Medium,L1 +18.10.57.3.11.2,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1,,1,,=,,Medium,L1 +18.10.58.1,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium,L1 +18.10.58.2,"Administrative Templates: Windows Components","RSS Feeds: Turn on Basic feed authentication over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",AllowBasicAuthInClear,,,,,,,0,,0,,=,,Medium,L1 +18.10.59.2,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,L2 +18.10.59.3,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium,L1 +18.10.59.4,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium,L2 +18.10.63.1,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0,,1,,=,,Medium,L2 +18.10.76.2.1.1,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium,L1 +18.10.76.2.1.2,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium,L1 +18.10.80.1,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1,,0,,=,,Medium,L2 +18.10.80.2,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,<=,,Medium,L1 +18.10.81.1,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium,L1 +18.10.81.2,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +18.10.81.3,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,L2 +18.10.82.1,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium,L1 +18.10.82.2,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium,L1 +18.10.87.1,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium,L2 +18.10.87.2,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium,L2 +18.10.89.1.1,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium,L1 +18.10.89.1.2,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium,L1 +18.10.89.1.3,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium,L1 +18.10.89.2.1,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium,L1 +18.10.89.2.2,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,L2 +18.10.89.2.3,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium,L1 +18.10.89.2.4,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium,L1 +18.10.90.1,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,L2 +18.10.92.2.1,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,,,1,,=,,Medium,L1 +18.10.93.1.1,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0,,0,,=,,Medium,L1 +18.10.93.2.1,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0,,0,,=,,Medium,L1 +18.10.93.2.2,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,,,0,,=,,Medium,L1 +18.10.93.4.1.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,1,,=,,Medium,L1 +18.10.93.4.1.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,,,0,,=,,Medium,L1 +18.10.93.4.2.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,1,,=,,Medium,L1 +18.10.93.4.2.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,,,2,,=,,Low,L1 +18.10.93.4.2.3,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,,,180,,>=,,Medium,L1 +18.10.93.4.3.1,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,,,1,,=,,Medium,L1 +18.10.93.4.3.2,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,,,0,,=,,Medium,L1 diff --git a/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv b/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv new file mode 100644 index 0000000..e444ad5 --- /dev/null +++ b/vendor/lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv @@ -0,0 +1,13 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +19.5.1.1,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,L1 +19.6.6.1.1,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,L2 +19.7.5.1,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,,,2,,=,,Medium,L1 +19.7.5.2,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,,,3,,=,,Medium,L1 +19.7.8.1,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,,,2,,=,,Medium,L1 +19.7.8.2,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,L1 +19.7.8.3,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,L2 +19.7.8.4,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0,,1,,=,,Medium,L2 +19.7.8.5,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,,,1,,=,,Medium,L1 +19.7.26.1,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0,,1,,=,,Medium,L1 +19.7.44.1,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,L1 +19.7.46.2.1,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,,,1,,=,,Medium,L2 diff --git a/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv b/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv new file mode 100644 index 0000000..4363057 --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv @@ -0,0 +1,394 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-63415,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,=,,Medium, +V-63419,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,=,,Medium, +V-63421,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,=,,Medium, +V-63423,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,=,,Medium, +V-63427,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +V-63429,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +V-63405,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-63409,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,=,,Medium, +V-63413,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-63843,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +V-63845,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +V-63847,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,High, +V-63851,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +V-63853,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +V-63855,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE",,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE;NT SERVICE\autotimesvc",,=,,Medium, +V-63857,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63859,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,High, +V-63861,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-63863,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +V-63865,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63869,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,High, +V-63871,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account;Domain Admins;Enterprise Admins",,=,,Medium, +V-63873,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,"Domain Admins;Enterprise Admins",,=,,Medium, +V-63875,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,"Domain Admins;Enterprise Admins",,=,,Medium, +V-63877,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;Domain Admins;Enterprise Admins",,=,,Medium, +V-63879,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account;BUILTIN\Guests;Domain Admins;Enterprise Admins",,=,,Medium, +V-63881,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +V-63883,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63889,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-63917,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63925,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +V-63927,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63931,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63933,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63935,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63939,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +V-63941,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-63601,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False,,False,,=,,Medium, +V-63611,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +V-63617,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +V-63619,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,X_Admin,,=,,Medium, +V-63625,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Visitor,,=,,Medium, +V-71761,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Medium, +V-63639,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +V-63643,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-63647,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-63653,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Low, +V-63661,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,=,,Low, +V-63665,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +V-63669,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Medium, +V-63675,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.",,=,,Medium, +V-63681,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,"US Department of Defense Warning Statement",,=,,Low, +V-63687,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10,,10,,=,,Low, +V-63697,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +V-63703,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-63711,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +V-63719,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-63739,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,High, +V-63745,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,High, +V-63749,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,High, +V-63755,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +V-63759,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,High, +V-71769,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +V-63765,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +V-63767,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +V-63795,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,=,,Medium, +V-63797,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +V-63801,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,High, +V-63803,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +V-63805,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +V-63807,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +V-63811,"Security Options","System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy,Enabled,,,,,,,,,1,,=,,Medium, +V-220943,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Low, +V-63817,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +V-63819,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +V-63821,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +V-63825,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +V-63827,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +V-63829,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +V-63831,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +V-74719,"System Services","Secondary Logon (seclogon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\seclogon,Start,,,,,,,3,,4,,=,,Medium, +V-74719,"System Services","Secondary Logon (seclogon) (Service Startup type)",service,seclogon,,,,,,,,,Manual,,Disabled,,=,,Medium, +"V-63431 / V-63435","Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-63445,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-63447 / V-63449","Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +V-63451,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-63453,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-71759,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Medium, +V-63457,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-63459,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-63463 / V-63467","Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +"V-99541 / V-99543","Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-63469,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-99545,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Medium, +"V-74721 / V-75027","Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-74409 / V-74411","Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-63471 / V-63473","Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-63479,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-63481,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-71761,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-99547 / V-99549","Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-99553,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Medium, +"V-63483 / V-63487","Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-63491,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Medium, +"V-63499 / V-63503","Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-63507,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-63513,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-63515 / V-63517","Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-63545,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Medium, +V-63549,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +V-63597,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +V-74725,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +V-74723,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +V-68849,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,High, +V-72329,"MS Security Guide","Remove ""Run As Different User"" from context menus (batfile)",Registry,,HKLM:\SOFTWARE\Classes\batfile\shell\runasuser," SuppressionPolicy",,,,,,,,,1000,,=,,Medium, +V-72329,"MS Security Guide","Remove ""Run As Different User"" from context menus (cmdfile)",Registry,,HKLM:\SOFTWARE\Classes\cmdfile\shell\runasuser," SuppressionPolicy",,,,,,,,,1000,,=,,Medium, +V-72329,"MS Security Guide","Remove ""Run As Different User"" from context menus (exefile)",Registry,,HKLM:\SOFTWARE\Classes\exefile\shell\runasuser," SuppressionPolicy",,,,,,,,,1000,,=,,Medium, +V-72329,"MS Security Guide","Remove ""Run As Different User"" from context menus (mscfile)",Registry,,HKLM:\SOFTWARE\Classes\mscfile\shell\runasuser," SuppressionPolicy",,,,,,,,,1000,,=,,Medium, +V-71763,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,Medium, +V-63555,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +V-63559,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +V-63563,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Low, +V-63567,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Low, +V-63569,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +V-71765,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +V-63577,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-63577,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-74413,"Administrative Templates: Network","SSL Configuration Settings: ECC Curve Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,EccCurves,,,,,,,,,NistP384;NistP256,,=,,Medium, +V-71765,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +V-63591,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +V-68817,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +V-74699,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +V-63595,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Low, +V-63595,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Low, +V-63603,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Low, +V-77083,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Low, +V-63599,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,High, +V-63607,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +V-63609,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +V-63609,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +V-63615,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +V-63621,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +V-63623,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +V-99557,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +V-63629,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +V-63633,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +V-99559,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +V-63721,"Administrative Templates: System","PIN Complexity: Minimum PIN length",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity,MinimumPINLength,,,,,,,,,6,,=,,Medium, +V-63645,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +V-63649,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +V-63651,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,High, +V-63657,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +V-94719,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +V-63659,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +V-63663,"Administrative Templates: Windows Components","Application Compatibility: Turn off Inventory Collector",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInventory,,,,,,,0,,1,,=,,Low, +V-63667,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,High, +V-63671,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,High, +V-63673,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,High, +V-63677,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +V-94861,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,MinimumPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesMinimumPINLength,,,,,,6,,=,,Medium, +V-94859,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,1,,=,,Medium, +V-94859,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +V-94859,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +V-94859,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +V-94859,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium, +V-71771,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Low, +V-63679,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +V-63683,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,2,,=,,Medium, +V-65681,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +V-63519,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +V-63523,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,1024000,,>=,,Medium, +V-63527,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +V-63709,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +V-63701,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +V-82139,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +V-63713,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +V-63699,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +V-63729,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +V-63731,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +V-63733,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +V-63737,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +V-63741,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +V-63743,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +V-63751,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Use a common set of exploit protection settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection",ExploitProtectionSettings,,,,,,,,,,,!=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Override Relocate Images (ASLR) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ASLR/OverrideForceRelocateImages,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77235,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-77205,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (firefox.exe)",ProcessmitigationApplication,firefox.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77205,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (firefox.exe)",ProcessmitigationApplication,firefox.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-77209,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-77213,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77189,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77191,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77195,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (chrome.exe)",ProcessmitigationApplication,chrome.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77201,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77217,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77221,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (java.exe)",ProcessmitigationApplication,java.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaw.exe)",ProcessmitigationApplication,javaw.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaws.exe)",ProcessmitigationApplication,javaws.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77223,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77227,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77231,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,0,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77233,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77239,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77243,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77245,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77247,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,0,,Medium, +V-77249,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77255,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-220898,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77263,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77267,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-77269,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-63685,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +V-63685,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +V-74417,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +V-63717,"Administrative Templates: Windows Components","Windows Hello for Business: Use a hardware security device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork,RequireSecurityDevice,,,,,,,,,1,,=,,Medium, +V-99561,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,0,,=,,Medium, +V-63321,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +V-63325,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,High, +V-63333,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +V-68819,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +V-230220,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Medium, +V-63335,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,High, +V-63339,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +V-71763,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +V-63347,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,High, +V-63369,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +V-63375,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv b/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv new file mode 100644 index 0000000..8de61c6 --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv @@ -0,0 +1,5 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-63839,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Low, +V-99563,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Low, +V-102617,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn off Preview Pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoReadingPane,,,,,,,,,1,,=,,Medium, +V-102617,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn on or off details pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPreviewPane,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv new file mode 100644 index 0000000..12e421b --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv @@ -0,0 +1,361 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-93479,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,=,,Medium, +V-93477,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,=,,Medium, +V-93471,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,=,,Medium, +V-93463,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,=,,Medium, +V-93459,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +V-93465,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +V-93145,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-93141,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,=,,Medium, +V-93143,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-93049,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +V-93007,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS",,=,,Medium, +V-93051,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,High, +V-93039,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users",,BUILTIN\Administrators,,=,,Medium, +V-93017,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +V-92997,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93053,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +V-93055,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93057,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,High, +V-93059,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93061,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +V-93063,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93065,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,High, +V-93009,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,BUILTIN\Guests,,=,,Medium, +V-93011,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +V-93013,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,"",,=,,Medium, +V-93015,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,BUILTIN\Guests,,=,,Medium, +V-92963,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +V-93047,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +V-93067,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93069,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93071,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93073,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +V-93075,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93077,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +V-93197,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93079,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93081,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93083,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93085,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +V-93087,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93497,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +V-93279,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,High, +V-93281,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,X_Admin,,=,,Medium, +V-93283,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Visitor,,=,,Medium, +V-93545,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Medium, +V-93273,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1,,0,,=,,Medium, +V-93151,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Medium, +V-93547,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +V-93549,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-93551,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-93455,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Low, +V-93285,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,=,,Low, +V-93553,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +V-92961,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Medium, +V-93147,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.",,=,,Medium, +V-93149,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,"US Department of Defense Warning Statement",,=,,Low, +V-93287,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +V-93555,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-93557,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +V-93469,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +V-93559,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-93561,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +V-93289,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,High, +V-93291,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,High, +V-93537,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,High, +V-93293,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +V-93539,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,High, +V-93045,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +V-93295,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +V-93297,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +V-93299,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +V-93495,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,=,,Medium, +V-93467,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +V-93301,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,High, +V-93303,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +V-93305,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +V-93307,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +V-93493,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,=,,Medium, +V-93511,"Security Options","System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy,Enabled,,,,,,,,,1,,=,,Medium, +V-93309,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Low, +V-93431,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +V-93521,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableUIADesktopToggle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_AllowUIAccessApplicationsToPromptForElevation,,,,,,0,,=,,Medium, +V-93523,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +V-93433,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +V-93525,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +V-93527,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +V-93435,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +V-93529,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +"V-93153 / V-93155","Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-92985,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-93089,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Medium, +V-92979,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-92981 / V-92983","Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +V-93157,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-93091,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-93133 / V-93135","Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +"V-93137 / V-93139","Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,"Success and Failure",,=,,Medium, +V-92989,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Medium, +V-93159,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-93171,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-92967 / V-92969","Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93161,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-93163 / V-93165","Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93167 / V-93169","Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93095 / V-93099","Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +V-93097,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-93099,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-93101 / V-93103","Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93105 / V-93107","Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93109 / V-93111","Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93113,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-93115,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-93117 / V-93119","Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93399,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +V-93395,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +V-93393,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +V-93401,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,Medium, +V-93233,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Low, +V-93235,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Low, +V-93237,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Low, +V-93541,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Low, +V-93239,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +V-93241,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-93241,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-93173,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +V-93243,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +V-93245,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Low, +V-93245,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Low, +V-93245,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Low, +V-93229,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Low, +V-93277,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,3,,=,,High, +V-93251,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +V-93251,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +V-93403,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +V-93403,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +V-93407,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +V-93253,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +V-93255,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +V-93409,"Administrative Templates: Windows Components","Application Compatibility: Turn off Inventory Collector",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInventory,,,,,,,0,,1,,=,,Low, +V-93373,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,High, +V-93375,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,High, +V-93377,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,High, +V-93517,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +V-93257,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,=,,Medium, +V-93259,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +V-93177,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +V-93179,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +V-93181,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +V-93425,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +V-93533,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +V-93427,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +V-92971,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +V-92973,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +V-93265,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +V-93415,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Use a common set of exploit protection settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection",ExploitProtectionSettings,,,,,,,,,,,!=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Override Relocate Images (ASLR) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ASLR/OverrideForceRelocateImages,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93329,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (firefox.exe)",ProcessmitigationApplication,firefox.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93329,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (firefox.exe)",ProcessmitigationApplication,firefox.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93325,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (chrome.exe)",ProcessmitigationApplication,chrome.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (java.exe)",ProcessmitigationApplication,java.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaw.exe)",ProcessmitigationApplication,javaw.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaws.exe)",ProcessmitigationApplication,javaws.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,0,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,0,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93411,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +V-93411,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +V-93199,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +V-93201,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,High, +V-93269,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +V-93175,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +V-93503,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,High, +V-93499,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +V-93505,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +V-93507,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,High, +V-93501,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +V-93429,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv new file mode 100644 index 0000000..9cb722e --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv @@ -0,0 +1,3 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-102625,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn off Preview Pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoReadingPane,,,,,,,,,1,,=,,Medium, +V-102625,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn on or off details pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPreviewPane,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv new file mode 100644 index 0000000..d62129e --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv @@ -0,0 +1,357 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-93479,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,=,,Medium, +V-93477,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42,,60,,=,,Medium, +V-93471,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0,,1,,=,,Medium, +V-93463,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,=,,Medium, +V-93459,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +V-93465,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +V-93145,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-93141,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,=,,Medium, +V-93143,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,=,,Medium, +V-93049,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +V-93007,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +V-93051,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,High, +V-93017,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +V-93053,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +V-93055,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93057,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,High, +V-93059,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93061,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +V-93063,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93065,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,High, +V-93009,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"Guest;NT AUTHORITY\Local account;Domain Admins;Enterprise Admins",,=,,Medium, +V-93011,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,"Domain Admins;Enterprise Admins",,=,,Medium, +V-93013,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,"Domain Admins;Enterprise Admins",,=,,Medium, +V-93015,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests,,"BUILTIN\Guests;Domain Admins;Enterprise Admins",,=,,Medium, +V-92963,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account;BUILTIN\Guests;Domain Admins;Enterprise Admins",,=,,Medium, +V-93047,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,"",,=,,Medium, +V-93067,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93069,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93071,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +V-93073,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +V-93075,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93077,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +V-93197,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93079,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93081,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93083,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93085,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +V-93087,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +V-93497,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False,,False,,=,,Medium, +V-93279,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,High, +V-93281,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator,,X_Admin,,=,,Medium, +V-93283,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest,,Visitor,,=,,Medium, +V-93151,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Medium, +V-93547,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +V-93549,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-93551,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +V-93455,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Low, +V-93285,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,=,,Low, +V-93553,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +V-92961,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Medium, +V-93147,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,,,"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.",,=,,Medium, +V-93149,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,,,"US Department of Defense Warning Statement",,=,,Low, +V-93287,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Medium, +V-93555,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-93557,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium, +V-93469,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +V-93559,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +V-93561,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium, +V-93289,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,High, +V-93291,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,High, +V-93537,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,High, +V-93293,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0,,0,,=,,Medium, +V-93539,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,High, +V-93045,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +V-93295,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0,,1,,=,,Medium, +V-93297,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +V-93299,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,,,0,,=,,Medium, +V-93495,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644,,2147483640,,=,,Medium, +V-93467,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +V-93301,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,High, +V-93303,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +V-93305,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +V-93307,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +V-93493,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,,,1,,=,,Medium, +V-93511,"Security Options","System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy,Enabled,,,,,,,,,1,,=,,Medium, +V-93309,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Low, +V-93431,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +V-93521,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableUIADesktopToggle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_AllowUIAccessApplicationsToPromptForElevation,,,,,,0,,=,,Medium, +V-93523,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +V-93433,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +V-93525,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +V-93527,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +V-93435,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +V-93529,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +"V-93153 / V-93155","Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +V-92985,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-92979,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-92981 / V-92983","Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +V-93157,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-93091,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-92989,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Medium, +V-93159,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +V-93171,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-92967 / V-92969","Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93161,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +"V-93163 / V-93165","Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93167 / V-93169","Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93095 / V-93099","Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Medium, +V-93097,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-93099,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-93101 / V-93103","Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93105 / V-93107","Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Medium, +"V-93109 / V-93111","Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93113,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Medium, +V-93115,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Medium, +"V-93117 / V-93119","Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Medium, +V-93399,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +V-93519,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0,,0,,=,,Medium, +V-93395,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +V-93393,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +V-93401,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,Medium, +V-93233,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Low, +V-93235,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Low, +V-93237,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Low, +V-93541,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Low, +V-93239,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +V-93241,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-93241,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +V-93173,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,0,,=,,Medium, +V-93243,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +V-93245,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Low, +V-93245,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Low, +V-93245,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Low, +V-93229,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Low, +V-93277,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,High, +V-93251,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Medium, +V-93251,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Medium, +V-93403,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +V-93403,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0,,1,,=,,Medium, +V-93407,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium, +V-93419,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +V-93253,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +V-93255,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +V-93453,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +V-93409,"Administrative Templates: Windows Components","Application Compatibility: Turn off Inventory Collector",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInventory,,,,,,,0,,1,,=,,Low, +V-93373,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,High, +V-93375,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,High, +V-93377,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,High, +V-93517,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +V-93257,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,=,,Medium, +V-93259,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,2,,=,,Medium, +V-93177,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +V-93179,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +V-93181,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +V-93425,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +V-93533,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +V-93427,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +V-92971,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +V-92973,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +V-93265,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +V-93415,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Use a common set of exploit protection settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection",ExploitProtectionSettings,,,,,,,,,,,!=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Override Relocate Images (ASLR) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ASLR/OverrideForceRelocateImages,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93349,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93329,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (firefox.exe)",ProcessmitigationApplication,firefox.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93329,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (firefox.exe)",ProcessmitigationApplication,firefox.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93331,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,,,False,,=,,Medium, +V-93333,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ChildProcess/OverrideChildProcess,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93321,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93323,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93325,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (chrome.exe)",ProcessmitigationApplication,chrome.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93327,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (java.exe)",ProcessmitigationApplication,java.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaw.exe)",ProcessmitigationApplication,javaw.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaws.exe)",ProcessmitigationApplication,javaws.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93341,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93343,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,0,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93351,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93353,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,0,,Medium, +V-93357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93361,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/ASLR/ForceRelocateImages,,,,,,,,,,,ON,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93363,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/DEP/OverrideDEP,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,,,False,,=,,Medium, +V-93367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,,,False,,=,,Medium, +V-93411,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +V-93411,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +V-93199,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +V-93201,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,High, +V-93269,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +V-93175,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +V-93503,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,High, +V-93499,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +V-93505,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +V-93507,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,High, +V-93501,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +V-93429,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv new file mode 100644 index 0000000..9cb722e --- /dev/null +++ b/vendor/lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv @@ -0,0 +1,3 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-102625,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn off Preview Pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoReadingPane,,,,,,,,,1,,=,,Medium, +V-102625,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn on or off details pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPreviewPane,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv b/vendor/lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv new file mode 100644 index 0000000..9a3c6c9 --- /dev/null +++ b/vendor/lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv @@ -0,0 +1,32 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-75147,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,=,,High, +V-75159,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Turn off Auto Exclusions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Exclusions",DisableAutoExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableAutoExclusions,,,,,,0,,=,,Medium, +V-75163,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,=,,Medium, +V-75167,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +V-75207,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +V-75235,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +V-75237,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Specify the day of the week to run a scheduled scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",ScheduleDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_ScheduleDay,,,,,,0,,=,,Medium, +V-75239,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1,,0,,=,,Medium, +V-75241,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before spyware security intelligence is considered out of date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",ASSignatureDue,,,,,,,,,7,,=,,High, +V-75243,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before virus security intelligence is considered out of date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",AVSignatureDue,,,,,,,,,7,,=,,High, +V-75245,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Specify the day of the week to check for security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",ScheduleDay,,,,,,,,,0,,=,,Medium, +V-75247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Threats",Threats_ThreatSeverityDefaultAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,,,1,,=,,Medium, +V-75247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Low (1)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,,,2,,=,,Medium, +V-75247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Medium (2)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,,,2,,=,,Medium, +V-75247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: High (4)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,,,2,,=,,Medium, +V-75247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Severe (5)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,,,2,,=,,Medium, +V-77967,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77967,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +V-77969,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77969,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +V-77975,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77975,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +V-77971,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77971,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +V-77977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +V-77965,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77965,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +V-77973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +V-77973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +V-75209,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_dod_windows_firewall_stig_v1r7.csv b/vendor/lists/finding_list_dod_windows_firewall_stig_v1r7.csv new file mode 100644 index 0000000..a78f832 --- /dev/null +++ b/vendor/lists/finding_list_dod_windows_firewall_stig_v1r7.csv @@ -0,0 +1,19 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +V-17415,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +V-17418,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,High, +V-17419,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +V-17425,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,=,,Low, +V-17426,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Low, +V-17427,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +V-17416,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +V-17428,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,High, +V-17429,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +V-17435,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,=,,Low, +V-17436,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Low, +V-17437,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +V-17417,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +V-17438,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,High, +V-17429,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +V-17445,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,=,,Low, +V-17446,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Low, +V-17447,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, diff --git a/vendor/lists/finding_list_intune.csv b/vendor/lists/finding_list_intune.csv new file mode 100644 index 0000000..dd39a37 --- /dev/null +++ b/vendor/lists/finding_list_intune.csv @@ -0,0 +1,1898 @@ +Id,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune +1621,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,, +1619,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,, +1617,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,, +1615,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,, +1620,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,, +1618,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,, +1616,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,, +1614,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,, +2,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30, +3,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never, +1695,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1, +338,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None, +339,"Account Policies","Maximum password age",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordExpiration,,,,42, +340,"Account Policies","Minimum password age",accountpolicy,,,,,,,,,,0, +341,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0, +342,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0, +343,"Account Policies","Relax minimum password length limits",Registry,,HKLM:\System\CurrentControlSet\Control\SAM,RelaxMinimumPasswordLengthLimits,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,RelaxMinimumPasswordLengthLimits,,,,0,0 +4,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30, +344,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0, +1937,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable WPAD",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp",DisableWpad,,,,,,,, +1938,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable proxy authentication",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",DisableProxyAuthenticationSchemes,,,,,,,, +530,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1, +735,"Administrative Templates: Control Panel","Enable screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveActive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_EnableScreenSaver,,,,, +801,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",SCRNSAVE.EXE,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_SetScreenSaver,,,,, +736,"Administrative Templates: Control Panel","Password protect the screen saver",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaverIsSecure,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverIsSecure,,,,, +98,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0, +528,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0, +529,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1, +1551,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitInkCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitInkCollection,,,,,,,, +1552,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitTextCollection)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,RestrictImplicitTextCollection,,,,,,,, +737,"Administrative Templates: Control Panel","Screen saver timeout",Registry,,"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",ScreenSaveTimeOut,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ControlPanelDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ControlPanelDisplay,CPL_Personalization_ScreenSaverTimeOut,,,,, +532,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0, +785,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordExpirationProtectionEnabled,,,,,,,0, +533,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0, +786,"Administrative Templates: LAPS","Enable local admin password management (Member)",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0, +531,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,, +784,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{D76B9641-3288-4f75-942D-087DE603E3EA}",DllName,,,,,,,, +536,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30, +789,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordAgeDays,,,,,,,30, +534,"Administrative Templates: LAPS","Password Settings: Password Complexity",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4, +787,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordComplexity,,,,,,,4, +535,"Administrative Templates: LAPS","Password Settings: Password Length",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14, +788,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd",PasswordLength,,,,,,,14, +1666,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DoHPolicy,,,,,,,, +1697,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,, +1887,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMDNS,,,,,,,0, +1888,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",DisableIPv6DefaultDnsServers,,,,,,,0, +99,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1, +568,"Administrative Templates: Network","Disable IPv6",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters,DisabledComponents,,,,,,,0, +553,"Administrative Templates: Network","Fonts: Enable Font Providers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableFontProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowFontProviders,,,,1, +1829,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0, +1830,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0, +1831,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0, +1832,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1, +1833,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1, +1834,"Administrative Templates: Network","Lanman Server: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MaxSmb2Dialect,,,,,,,, +1835,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,, +1836,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,, +1837,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0, +1838,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0, +1839,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0, +100,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1, +1840,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1, +1841,"Administrative Templates: Network","Lanman Workstation: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MaxSmb2Dialect,,,,,,,, +1842,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,, +1843,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0, +556,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0, +555,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOndomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0, +557,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0, +558,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableLLTDIO,,,,0, +563,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_AllowNetBridge_NLA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,ProhibitInstallationAndConfigurationOfNetworkBridge,,,,0, +564,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1, +565,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_StdDomainUserSetLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_NetworkConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_NetworkConnections,NC_StdDomainUserSetLocation,,,,0, +566,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,, +567,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,, +1328,"Administrative Templates: Network","SSL Configuration Settings: ECC Curve Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,EccCurves,,,,,,,, +1602,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,, +1907,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (NULL bulk encryption)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,, +1906,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (RSA key transport)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,, +101,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",Registry,,HKLM:\Software\policies\Microsoft\Peernet,Disabled,,,,,,,0, +559,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD,AllowRspndrOnDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0, +560,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0, +561,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0, +562,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_LinkLayerTopologyDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_LinkLayerTopologyDiscovery,LLTD_EnableRspndr,,,,0, +102,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1, +572,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar,,,,,,,1, +571,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar,,,,,,,1, +570,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar,,,,,,,1, +573,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar,,,,,,,1, +569,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_EnableRegistrar,,,,1, +574,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsConnectNow,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsConnectNow,WCN_DisableWcnUi_1,,,,0, +575,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fMinimizeConnections,,,,,,,1, +576,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0, +1751,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0, +1759,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0, +1764,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0, +1765,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0, +1752,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,, +1760,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,, +1748,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0, +1756,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0, +1749,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0, +1757,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0, +1750,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0, +1758,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0, +1753,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0, +1761,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0, +1754,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0, +1762,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0, +1755,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0, +1763,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0, +1667,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1, +1700,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,, +1699,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,, +1702,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,, +1701,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,, +1703,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,, +1844,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,, +1698,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,, +1930,"Administrative Templates: Printers","Configure Windows Ready Print driver ranking",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\DriverRanking",UseWindowsReadyPrintDriverRankingGroupPolicy,,,,,,,, +1889,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0, +1704,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,, +1705,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,, +1650,"Administrative Templates: Printers","Only use Package Point and Print (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintOnly,,,,,,,, +1651,"Administrative Templates: Printers","Package Point and Print - Approved servers (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintServerList,,,,,,,, +1645,"Administrative Templates: Printers","Point and Print Restrictions: Only administrators can install printer drivers on a print server (CVE-2021-34527)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,, +1668,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0, +1643,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0, +1669,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0, +1644,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0, +1931,"Administrative Templates: Printers","Require IPPS for IPP printers",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",RequireIpps,,,,,,,, +1932,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockUnknownCA,,,,,,,, +1934,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertCNInvalid,,,,,,,, +1935,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertDateInvalid,,,,,,,, +1933,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow non-server certificates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\IPP",SecurityFlagsBlockCertWrongUsage,,,,,,,, +298,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion,NoCloudApplicationNotification,,,,,,,0, +577,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0, +299,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0, +1805,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0, +578,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0, +1845,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,, +103,"Administrative Templates: System","Credentials Delegation: Allow delegation default credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowDefaultCredentials,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowDefaultCredentials,,,,1, +104,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0, +819,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0, +114,"Administrative Templates: System","Device Guard: Available Security Properties: DMA protection",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,3, +113,"Administrative Templates: System","Device Guard: Available Security Properties: Secure Boot",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,2, +793,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,, +792,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,, +582,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,, +1706,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,, +119,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,, +120,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0, +115,"Administrative Templates: System","Device Guard: Security Services Configured: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available", +116,"Administrative Templates: System","Device Guard: Security Services Configured: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available", +117,"Administrative Templates: System","Device Guard: Security Services Running: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available", +118,"Administrative Templates: System","Device Guard: Security Services Running: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available", +580,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,, +1307,"Administrative Templates: System","Device Guard: Support for Virtualization Based Security (Microsoft-Hyper-V-Hypervisor)",WindowsOptionalFeature,Microsoft-Hyper-V-Hypervisor,,,,,,,,,Disabled, +579,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,, +581,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,, +112,"Administrative Templates: System","Device Guard: Virtualization Based Security Status",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,VirtualizationBasedSecurityStatus,"Not available", +121,"Administrative Templates: System","Device Guard: Windows Defender Application Control deployed (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,DeployConfigCIPolicy,,,,,,,0, +107,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0010,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0, +108,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0, +105,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0, +106,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0, +586,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,6bdd1fc1-810f-11d0-bec7-08002be2092f,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +584,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,7ebefbc0-3200-11d2-b4c2-00a0C9697d07,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +109,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +110,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +585,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,c06ff265-ae09-48f0-812c-16753d7cba83,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +111,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0, +1684,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata",PreventDeviceMetadataFromNetwork,,,,,,,, +122,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0, +1936,"Administrative Templates: System","Filesystem: Enable / disable CLFS logfile authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Policies,ClfsAuthenticationChecking,,,,,,,, +1802,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1, +1688,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES11,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Security,,,,1, +587,"Administrative Templates: System","Group Policy: Continue experiences on this device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableCdp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,EnableCDP,,,,1, +124,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0, +123,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1, +588,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableBkGndGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,DisableBackgroundPolicy,,,,0, +300,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0, +592,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Internet Connection Wizard",ExitOnMSICW,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_ExitOnISP,,,,0, +129,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0, +594,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Registration Wizard Control",NoRegistration,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,NC_NoRegistration,,,,0, +595,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,SearchCompanion_DisableFileUpdates,,,,0, +130,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1, +127,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1, +128,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0, +589,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoUseStoreOpenWith,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellNoUseStoreOpenWith_1,,,,0, +126,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0, +590,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing,,,,,,,0, +591,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports,,,,,,,0, +593,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers",DisableHTTPPrinting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisablePrintingOverHTTP,,,,0, +596,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemoveOrderPrints_1,,,,0, +597,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,ShellRemovePublishToWeb_1,,,,0, +125,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0, +1846,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,, +1847,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,, +1848,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,, +1849,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,, +1850,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,, +1851,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,, +1852,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,, +1853,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,, +1854,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,, +1855,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,, +598,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1, +599,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\kerberos\parameters,DevicePKInitEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Kerberos,DevicePKInitEnabled,,,,1, +131,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2, +1785,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,, +1806,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordExpirationProtectionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordExpirationProtectionEnabled,,,,, +1786,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADBackupDSRMPassword,,,,,,,, +1787,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,, +1809,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordAgeDays,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordAgeDays,,,,, +1807,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordComplexity,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordComplexity,,,,, +1808,"Administrative Templates: System","LAPS: Password Settings: Password Length",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PasswordLength,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PasswordLength,,,,, +1811,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationActions,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationActions,,,,, +1810,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,PostAuthenticationResetDelay,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,PostAuthenticationResetDelay,,,,, +1707,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,, +1708,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,, +600,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Control Panel\International",BlockUserInputMethodsForSignIn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Globalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Globalization,BlockUserInputMethodsForSignIn,,,,0, +1777,"Administrative Templates: System","Logon: Always use classic logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,LogonType,,,,,,,, +601,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockUserFromShowingAccountDetailsOnSignin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,BlockUserFromShowingAccountDetailsOnSignin,,,,0, +134,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0, +603,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,DontEnumerateConnectedUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Logon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Logon,DontEnumerateConnectedUsers,,,,0, +604,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0, +794,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0, +133,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0, +605,"Administrative Templates: System","Logon: Turn off picture password sign-in",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,BlockDomainPicturePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,BlockPicturePassword,,,,0, +132,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1, +135,"Administrative Templates: System","Mitigation Options: Untrusted Font Blocking",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions",MitigationOptions_FontBocking,,,,,,,0, +1890,"Administrative Templates: System","Net Logon: DC Locator DNS Records: Block NetBIOS-based discovery for domain controller location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Netlogon\Parameters,BlockNetbiosDiscovery,,,,,,,1, +136,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1, +606,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1, +1329,"Administrative Templates: System","PIN Complexity: Minimum PIN length",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity,MinimumPINLength,,,,,,,, +141,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1, +142,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1, +821,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,, +820,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,, +822,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,, +823,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,, +143,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0, +795,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0, +144,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0, +796,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0, +1891,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1, +1908,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (DC)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1, +1909,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamrChangeUserPasswordApiPolicy,,,,,,,1, +1685,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,, +1686,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,, +145,"Administrative Templates: System","Security Settings: Enable svchost.exe mitigation options",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig,EnableSvchostMitigationPolicy,,,,,,,0, +607,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,DCConnectivityInStandby_2,,,,1, +608,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Power,ACConnectivityInStandby_2,,,,1, +140,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1, +139,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1, +138,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0, +137,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0, +148,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0, +149,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0, +797,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0, +609,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSDT,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSDT,MsdtSupportProvider,,,,1, +1548,"Administrative Templates: System","Trusted Platform Module Services: Ignore the default list of blocked TPM commands",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM\BlockedCommands,IgnoreDefaultList,,,,,,,, +1549,"Administrative Templates: System","Trusted Platform Module Services: Standard User Lockout Duration",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureDuration,,,,,,,, +1550,"Administrative Templates: System","Trusted Platform Module Services: Standard User Total Lockout Threshold",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\TPM,StandardUserAuthorizationFailureTotalThreshold,,,,,,,, +147,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0, +146,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WDI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WDI,WdiDpsScenarioExecutionPolicy,,,,1, +150,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1, +1895,"Administrative Templates: Windows Components","App Package Deployment: Not allow per-user unsigned packages to install by default (requires explicitly allow per install)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,DisablePerUserUnsignedPackagesByDefault,,,,,,,0, +610,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx,BlockNonAdminUserInstall,,,,,,,0, +151,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0, +1892,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableAPISamping,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffAPISamping,,,,0, +1893,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableApplicationFootprint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffApplicationFootprint,,,,0, +1894,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInstallTracing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffInstallTracing,,,,0, +722,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection",DisallowExploitProtectionOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsDefenderSecurityCenter,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsDefenderSecurityCenter,DisallowExploitProtectionOverride,,,,, +611,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0, +152,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0, +153,"Administrative Templates: Windows Components","Application Compatibility: Turn off Application Telemetry",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AppCompat,AITEnable,,,,,,,1, +962,"Administrative Templates: Windows Components","Application Compatibility: Turn off Inventory Collector",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInventory,,,,,,,0, +738,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,DoNotPreserveZoneInformation,,,,, +739,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\AttachmentManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\AttachmentManager,NotifyAntivirusPrograms,,,,, +155,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0, +156,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0, +154,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0, +157,"Administrative Templates: Windows Components","Biometrics: Allow the use of biometrics",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics,Enabled,,,,,,,1, +612,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,, +1318,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for fixed data drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsFdv,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6, +1317,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsOs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6, +1319,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for removable data drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsRdv,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,3, +159,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0, +1538,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Drive encryption method (for operating system drives)",BitLockerVolume,EncryptionMethod,,,,,,,,,None, +613,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVDiscoveryVolumeType,,,,,,,, +614,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,0, +615,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,1, +620,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +621,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +618,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +617,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +616,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +619,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,FixedDrivesRecoveryOptions,,,,, +622,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVHardwareEncryption,,,,,,,, +625,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowedHardwareEncryptionAlgorithms,,,,,,,, +624,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVRestrictHardwareEncryptionAlgorithms,,,,,,,0, +623,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowSoftwareEncryptionFailover,,,,,,,1, +626,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVPassphrase,,,,,,,0, +627,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVAllowUserCert,,,,,,,, +628,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\FVE,FDVEnforceUserCert,,,,,,,0, +160,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0, +162,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0, +629,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0, +630,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSManageDRA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1, +635,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryInfoToStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0, +636,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRequireActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0, +633,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHideRecoveryPage,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0, +632,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,1, +631,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRecoveryPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,, +634,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSActiveDirectoryBackup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRecoveryOptions,,,,0, +1330,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,MinimumPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesMinimumPINLength,,,,, +163,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0, +638,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowedHardwareEncryptionAlgorithms,,,,,,,, +637,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSRestrictHardwareEncryptionAlgorithms,,,,,,,0, +639,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSPassphrase,,,,,,,, +161,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0, +165,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1, +166,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0, +167,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0, +168,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0, +169,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0, +164,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSoftwareEncryptionFailover,,,,,,,0, +640,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDiscoveryVolumeType,,,,,,,, +641,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecovery,,,,,,,0, +642,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVManageDRA,,,,,,,, +648,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRequireActiveDirectoryBackup,,,,,,,, +647,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryInfoToStore,,,,,,,, +645,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHideRecoveryPage,,,,,,,, +644,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryKey,,,,,,,, +643,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRecoveryPassword,,,,,,,, +646,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVActiveDirectoryBackup,,,,,,,, +649,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVHardwareEncryption,,,,,,,, +652,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowedHardwareEncryptionAlgorithms,,,,,,,, +651,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVRestrictHardwareEncryptionAlgorithms,,,,,,,, +650,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowSoftwareEncryptionFailover,,,,,,,, +653,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVPassphrase,,,,,,,, +654,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVAllowUserCert,,,,,,,, +655,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVEnforceUserCert,,,,,,,, +656,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,, +657,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,, +158,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Volume status",BitLockerVolume,VolumeStatus,,,,,,,,,FullyDecrypted, +658,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Camera,AllowCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Camera,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Camera,AllowCamera,,,,1, +740,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,ConfigureWindowsSpotlight,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,ConfigureWindowsSpotlightOnLockScreen,,,,, +170,"Administrative Templates: Windows Components","Cloud Content: Do not show Windows tips",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableSoftLanding,,,,,,,0, +302,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0, +301,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0, +171,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0, +1663,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableSpotlightCollectionOnDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowSpotlightCollection,,,,, +741,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsSpotlightFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowWindowsSpotlight,,,,0, +1670,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,, +1313,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableCloudOptimizedContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableCloudOptimizedContent,,,,0, +659,"Administrative Templates: Windows Components","Connect: Require pin for pairing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect,RequirePinForPairing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WirelessDisplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WirelessDisplay,RequirePinForPairing,,,,0, +172,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0, +174,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1, +660,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0, +173,"Administrative Templates: Windows Components","Credential User Interface: Require trusted path for credential entry",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnableSecureCredentialPrompting,,,,,,,0, +175,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2, +176,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowDeviceNameInTelemetry,,,,,,,1, +661,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableEnterpriseAuthProxy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableEnterpriseAuthProxy,,,,0, +1671,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,, +662,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0, +1672,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,EnableOneSettingsAuditing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,EnableOneSettingsAuditing,,,,, +1673,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,, +1674,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,, +964,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Enhanced diagnostic data to the minimum required by Windows Analytics",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitEnhancedDiagnosticDataWindowsAnalytics,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitEnhancedDiagnosticDataWindowsAnalytics,,,,, +663,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds,AllowBuildPreview,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowBuildPreview,,,,1, +177,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1, +1766,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableAppInstaller,,,,, +1767,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableExperimentalFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableExperimentalFeatures,,,,, +1768,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableHashOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableHashOverride,,,,, +1896,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableLocalArchiveMalwareScanOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableLocalArchiveMalwareScanOverride,,,,, +1897,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableBypassCertificatePinningForMicrosoftStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableBypassCertificatePinningForMicrosoftStore,,,,, +1769,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableMSAppInstallerProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableMSAppInstallerProtocol,,,,, +1898,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DesktopAppInstaller,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DesktopAppInstaller,EnableWindowsPackageManagerCommandLineInterfaces,,,,1, +1626,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (AntiDetours)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,AntiDetours,,,,,,,, +1627,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (BannedFunctions)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,BannedFunctions,,,,,,,, +1628,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (DeepHooks)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DeepHooks,,,,,,,, +1629,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (ExploitAction)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ExploitAction,,,,,,,, +1630,"Administrative Templates: Windows Components","EMET: Default Protections for Internet Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,IE,,,,,,,, +1631,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Popular Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,, +1632,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Recommended Software)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\Defaults,*,,,,,,,, +1633,"Administrative Templates: Windows Components","EMET: System ASLR",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,ASLR,,,,,,,, +1634,"Administrative Templates: Windows Components","EMET: System DEP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,DEP,,,,,,,, +1635,"Administrative Templates: Windows Components","EMET: System SEHOP",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\EMET\SysSettings,SEHOP,,,,,,,, +664,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,ControlEventLogBehavior,,,,0, +178,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096, +1738,"Administrative Templates: Windows Components","Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PowerShell/Operational,MaxSize,,,,,,,15728640, +1747,"Administrative Templates: Windows Components","Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB)",Registry,"",HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\PowerShellCore/Operational,MaxSize,,,,,,,15728640, +665,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_2,,,,0, +179,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096, +666,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_3,,,,0, +668,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_LogMaxSize_3,,,,4096, +667,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",Registry,,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,Retention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_EventLog,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_EventLog,Channel_Log_Retention_4,,,,0, +180,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096, +181,"Administrative Templates: Windows Components","File Explorer: Allow the use of remote paths in file shortcut icons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,EnableShellShortcutIconRemotePath,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,EnableShellShortcutIconRemotePath,,,,0, +263,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1, +264,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn, +1856,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0, +1535,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn off Preview Pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoReadingPane,,,,,,,, +1536,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn on or off details pane",Registry,,HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPreviewPane,,,,,,,, +669,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffDataExecutionPreventionForExplorer,,,,0, +1774,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,, +670,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,TurnOffHeapTerminationOnCorruption,,,,0, +671,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,PreXPSP2ShellProtocolBehavior,,,,0, +182,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0, +1913,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,, +1770,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 as a standalone browser",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",NotifyDisableIEOptions,,,,,,,, +835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,, +836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,, +837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,, +838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,, +839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,, +840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,, +841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,, +834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,, +844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,, +854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,, +845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,, +846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,, +847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,, +848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,, +849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,, +851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,, +850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,, +852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,, +853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,, +855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,, +856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,, +857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,, +858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,, +859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,, +860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,, +861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,, +862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,, +863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,, +864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,, +865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,, +866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,, +867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,, +868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,, +869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,, +870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,, +871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,, +872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,, +873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,, +874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,, +875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,, +842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,, +876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,, +877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,, +878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,, +879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,, +880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,, +881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,, +882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,, +883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,, +884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,, +885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,, +886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,, +887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,, +894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,, +901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,, +888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,, +889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,, +890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,, +891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,, +892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,, +893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,, +895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,, +896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,, +898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,, +897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,, +899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,, +900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,, +902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,, +903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,, +904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,, +905,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,, +906,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,, +907,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,, +908,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,, +909,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,, +910,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,, +911,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,, +912,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,, +913,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,, +914,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,, +915,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,, +916,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,, +917,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,, +918,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,, +919,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,, +920,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,, +921,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,, +922,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,, +923,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,, +924,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,, +925,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,, +926,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,, +927,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,, +928,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,, +843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,, +824,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,, +825,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,, +826,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,, +827,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,, +930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,, +931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,, +929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,, +934,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,, +933,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,, +932,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,, +940,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,, +939,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,, +938,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,, +937,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,, +936,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,, +935,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,, +943,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,, +942,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,, +941,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,, +946,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,, +945,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,, +944,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,, +949,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,, +948,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,, +947,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,, +952,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,, +951,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,, +950,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,, +955,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,, +954,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,, +953,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,, +828,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,, +829,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,, +830,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,, +831,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,, +832,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,, +833,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,, +1694,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,, +1693,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,, +1692,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,, +1636,"Administrative Templates: Windows Components","Location and Sensors: Turn off Windows Location Provider",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableWindowsLocationProvider,,,,,,,0, +672,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0, +673,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging,AllowMessageSync,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Messaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Messaging,AllowMessageSync,,,,1, +214,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Automatic sample submission",MpPreference,SubmitSamplesConsent,,,,,,,,,1, +213,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Cloud-delivered protection",MpPreference,MAPSReporting,,,,,,,,,2, +212,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0, +1788,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableLocalAdminMerge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DisableLocalAdminMerge,,,,, +1857,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0, +1789,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,, +215,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Controlled folder access",MpPreference,EnableControlledFolderAccess,,,,,,,,,0, +1737,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable Tamper Protection (Status)",MpComputerStatus,IsTamperProtected,,,,,,,,,, +1642,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable sandboxing for Microsoft Defender Antivirus",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment",MP_FORCE_USE_SANDBOX,,,,,,,0, +1542,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions",MpPreferenceExclusion,ExclusionExtension,,,,,,,,,, +1539,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Extensions,,,,, +1543,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions",MpPreferenceExclusion,ExclusionPath,,,,,,,,,, +1540,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Paths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Paths,,,,, +1544,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions",MpPreferenceExclusion,ExclusionProcess,,,,,,,,,, +1541,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Processes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Processes,,,,, +1525,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Turn off Auto Exclusions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Exclusions",DisableAutoExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableAutoExclusions,,,,, +1858,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0, +675,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",LocalSettingOverrideSpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Spynet_LocalSettingOverrideSpynetReporting,,,,, +957,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,, +676,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0, +956,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,, +245,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0, +244,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +227,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0, +226,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +223,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0, +222,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +225,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0, +224,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +243,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0, +242,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +1823,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0, +1821,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +231,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0, +230,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +1641,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0, +1640,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +221,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0, +220,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +237,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0, +236,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +219,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0, +218,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +233,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0, +232,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +229,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0, +228,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0, +246,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +239,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0, +238,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +1817,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode",MpPreferenceAsr,33ddedf1-c6e0-47cb-833e-de6133960387,,,,,,,,,0, +1815,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",33ddedf1-c6e0-47cb-833e-de6133960387,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +241,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0, +240,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +1820,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools",MpPreferenceAsr,c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,,,,,,,,,0, +1818,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +1546,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules",MpPreferenceExclusion,AttackSurfaceReductionOnlyExclusions,,,,,,,,,, +1545,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_ASROnlyExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,ExploitGuard_ASR_ASROnlyExclusions,,,,0, +235,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0, +234,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +217,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0, +677,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,, +1866,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0, +1791,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpBafsExtendedTimeout,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpBafsExtendedTimeout,,,,0, +678,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,, +958,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0, +1859,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0, +216,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real time monitoring",MpPreference,DisableRealtimeMonitoring,,,,,,,,,False, +1793,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",RealtimeScanDirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_RealtimeScanDirection,,,,, +1860,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1, +1794,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableOnAccessProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableOnAccessProtection,,,,0, +959,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0, +960,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0, +679,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0, +1796,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScanOnRealtimeEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,RealtimeProtection_DisableScanOnRealtimeEnable,,,,0, +1653,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0, +1899,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Brute-Force Protection aggressiveness",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionAggressiveness,,,,0,0 +1900,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Remote Encryption Protection Mode",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection",BruteForceProtectionConfiguredState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,BruteForceProtectionConfiguredState,,,,,0 +1901,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Remote Encryption Protection: Configure how aggressively Remote Encryption Protection blocks threats",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection",RemoteEncryptionProtectionAggressiveness,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RemoteEncryptionProtectionAggressiveness,,,,0,0 +680,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting",DisableGenericRePorts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Reporting_DisablegenericrePorts,,,,0, +1861,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,, +1862,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0, +1795,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,, +681,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1, +1526,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Specify the day of the week to run a scheduled scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",ScheduleDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_ScheduleDay,,,,, +1902,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Trigger a quick scan after X days without any scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DaysUntilAggressiveCatchupQuickScan,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DaysUntilAggressiveCatchupQuickScan,,,,,30 +682,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableEmailScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableEmailScanning,,,,1, +1527,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before spyware security intelligence is considered out of date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",ASSignatureDue,,,,,,,, +1528,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before virus security intelligence is considered out of date",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",AVSignatureDue,,,,,,,, +1529,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Specify the day of the week to check for security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Signature Updates",ScheduleDay,,,,,,,, +1863,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,, +1864,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,, +1865,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,, +1530,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Threats",Threats_ThreatSeverityDefaultAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,, +1533,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: High (4)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,, +1531,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Low (1)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,, +1532,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Medium (2)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,, +1534,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Severe (5)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction",5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Threats_ThreatSeverityDefaultAction,,,,, +211,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0, +1790,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableRoutinelyTakingAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableRoutinelyTakingAction,,,,, +691,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\ServiceUI,ShowOneBox,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowAddressBarDropdown,,,,1, +692,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Addons,FlashPlayerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlash,,,,1, +1275,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,, +693,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,AllowInPrivate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowInPrivate,,,,1, +694,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Extensions,AllowSideloadingOfExtensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSideloadingOfExtensions,,,,1, +802,"Administrative Templates: Windows Components","Microsoft Edge: Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableSha1ForLocalAnchors,,,,,,,0, +1911,"Administrative Templates: Windows Components","Microsoft Edge: Allow software WebGL fallback using SwiftShader",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableUnsafeSwiftShader,,,,,,,, +1646,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,, +809,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1, +803,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1, +1662,"Administrative Templates: Windows Components","Microsoft Edge: Allow using the deprecated U2F Security Key API (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,U2fSecurityKeyApiEnabled,,,,,,,, +1784,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev117~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev117~Policy~microsoft_edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,,,,, +1659,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,, +811,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0, +812,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0, +696,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,, +697,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,AllowPopups,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPopups,,,,, +720,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,, +1925,"Administrative Templates: Windows Components","Microsoft Edge: Configure browser process code integrity guard setting",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserCodeIntegritySetting,,,,,,,, +695,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main,Cookies,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowCookies,,,,2, +698,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\SearchScopes,ShowSearchSuggestionsGlobal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSearchSuggestionsinAddressBar,,,,, +699,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Security,FlashClickToRunMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowFlashClickToRun,,,,, +807,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0, +806,"Administrative Templates: Windows Components","Microsoft Edge: Default Adobe Flash setting (obsolete)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DefaultPluginsSetting,,,,,,,0, +1824,"Administrative Templates: Windows Components","Microsoft Edge: Dynamic Code Settings",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DynamicCodeSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128~Policy~microsoft_edge,DynamicCodeSettings,,,,, +1654,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,, +1825,"Administrative Templates: Windows Components","Microsoft Edge: Enable Application Bound Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ApplicationBoundEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128.1~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128.1~Policy~microsoft_edge,ApplicationBoundEncryptionEnabled,,,,, +1926,"Administrative Templates: Windows Components","Microsoft Edge: Enable Process Isolation",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ProcessIsolationEnabled,,,,,,,, +1655,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,, +1927,"Administrative Templates: Windows Components","Microsoft Edge: Enable renderer in app container",Registry,,HKLM:\Software\Policies\Microsoft\Edge,RendererAppContainerEnabled,,,,,,,, +810,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1, +804,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0, +1928,"Administrative Templates: Windows Components","Microsoft Edge: Enable the network service sandbox",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NetworkServiceSandboxEnabled,,,,,,,, +1661,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,, +1929,"Administrative Templates: Windows Components","Microsoft Edge: Enhance the security state in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnhanceSecurityMode,,,,,,,, +1716,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,WebSQLAccess,,,,,,,, +805,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0, +700,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,PreventAccessToAboutFlagsInMicrosoftEdge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventAccessToAboutFlagsInMicrosoftEdge,,,,, +701,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,, +721,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,, +1690,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,, +814,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0, +702,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,, +703,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,HideLocalHostIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,HideLocalHostIPAddress,,,,, +1658,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,, +1648,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,, +1656,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,, +1647,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,, +808,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0, +674,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount,DisableUserAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSAPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSAPolicy,MicrosoftAccount_DisableUserAuth,,,,, +742,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInplaceSharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_Sharing,NoInplaceSharing,,,,0, +1649,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Feeds",EnableFeeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Feeds,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Feeds,EnableFeeds,,,,, +183,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0, +1637,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage on Windows 8.1",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSync,,,,,,,0, +704,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall,DisablePushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PushToInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PushToInstall,DisablePushToInstall,,,,, +713,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0, +1904,"Administrative Templates: Windows Components","RSS Feeds: Turn on Basic feed authentication over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",AllowBasicAuthInClear,,,,,,,0, +1775,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,, +184,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0, +185,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0, +798,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fSingleSessionPerUser,,,,,,,1, +1675,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",EnableUiaRedirection,,,,,,,, +705,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCcm,,,,,,,0, +706,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLPT,,,,,,,0, +1776,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableWebAuthn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowWebAuthnRedirection,,,,, +186,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0, +1676,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableLocationRedir,,,,,,,, +707,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisablePNPRedir,,,,,,,0, +1903,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,, +187,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0, +188,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0, +708,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SecurityLayer,,,,,,,0, +709,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",UserAuthentication,,,,,,,0, +189,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0, +1553,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: End session when time limits are reached",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fResetBroken,,,,,,,, +710,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxIdleTime,,,,,,,0, +711,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MaxDisconnectionTime,,,,,,,0, +712,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DeleteTempDirsOnExit,,,,,,,1, +799,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",PerSessionTempDir,,,,,,,1, +190,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1, +191,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1, +192,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1, +193,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1, +194,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1, +1771,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,, +195,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",ConnectedSearchPrivacy,,,,,,,1, +714,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform",NoGenTicket,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Licensing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Licensing,DisallowKMSClientOnlineAVSValidation,,,,0, +715,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableStoreApps,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,DisableStoreOriginatedApps,,,,, +716,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RequirePrivateStoreOnly,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,RequirePrivateStoreOnly,,,,, +717,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,AutoDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowAppStoreAutoUpdate,,,,, +719,"Administrative Templates: Windows Components","Store: Turn off the Store application",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,RemoveWindowsStore,,,,,,,, +718,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore,DisableOSUpgrade,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsStore,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsStore,DisableOSUpgrade_1,,,,, +1554,"Administrative Templates: Windows Components","Text Input: Improve inking and typing recognition",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput,AllowLinguisticDataCollection,,,,,,,, +1677,"Administrative Templates: Windows Components","Widgets: Allow widgets",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Dsh,AllowNewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\NewsAndInterests,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\NewsAndInterests,AllowNewsAndInterests,,,,, +203,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0, +204,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0, +205,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0, +207,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0, +206,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0, +208,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0, +209,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0, +1914,"Administrative Templates: Windows Components","Windows AI: Allow Recall to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WindowsAI,AllowRecallEnablement,,,,,,,, +1797,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WindowsAI,DisableAIDataAnalysis,,,,,,,0, +1798,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows (User)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\WindowsAI,DisableAIDataAnalysis,,,,,,,0, +1803,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot,TurnOffWindowsCopilot,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI,TurnOffWindowsCopilot,,,,0, +1812,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Automatic Data Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,CaptureThreatWindow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,AutomaticDataCollection,,,,, +1709,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,, +1915,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1, +1916,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn, +1772,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,, +1710,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,, +1711,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,, +1712,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,, +1639,"Administrative Templates: Windows Components","Windows Error Reporting: Automatically send memory dumps for OS-generated error reports",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",AutoApproveOSDumps,,,,,,,1, +1638,"Administrative Templates: Windows Components","Windows Error Reporting: Consent: Configure Default consent",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent",DefaultConsent,,,,,,,0, +196,"Administrative Templates: Windows Components","Windows Error Reporting: Disable Windows Error Reporting",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,,,,,,,0, +197,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1, +1773,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",Registry,,HKLM:\SOFTWARE\Microsoft\Policies\PassportForWork\Biometrics,EnableESSwithSupportedPeripherals,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\PassportForWork,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\PassportForWork,EnableESSwithSupportedPeripherals,,,,, +963,"Administrative Templates: Windows Components","Windows Hello for Business: Use a hardware security device",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork,RequireSecurityDevice,,,,,,,, +198,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1, +734,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowSuggestedAppsInWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkSpace,AllowSuggestedAppsInWindowsInkWorkspace,,,,1, +200,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1, +199,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0, +303,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0, +1657,"Administrative Templates: Windows Components","Windows Installer: Disable Co-Installer (USB AutoInstall)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer",DisableCoInstallers,,,,,,,, +201,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1, +1713,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,, +202,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0, +744,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",Registry,,HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer,PreventCodecDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WindowsMediaPlayer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WindowsMediaPlayer,PolicyCodecUpdate,,,,, +268,"Administrative Templates: Windows Components","Windows PowerShell: Disable PowerShell version 2",WindowsOptionalFeature,MicrosoftWindowsPowerShellV2,,,,,,,,,Enabled, +269,"Administrative Templates: Windows Components","Windows PowerShell: Disable PowerShell version 2 (root)",WindowsOptionalFeature,MicrosoftWindowsPowerShellV2Root,,,,,,,,,Enabled, +307,"Administrative Templates: Windows Components","Windows PowerShell: PowerShell Language Mode",LanguageMode,,,,,,,,,,FullLanguage, +1739,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0, +1742,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0, +1740,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,, +1743,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,, +265,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0, +304,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0, +266,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0, +305,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0, +267,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0, +306,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0, +1741,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0, +1744,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0, +1556,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,EnableScripts,,,,,,,, +1555,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution (Execution Policy)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell,ExecutionPolicy,,,,,,,, +210,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1, +1678,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowClipboardRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowClipboardRedirection,,,,, +1905,"Administrative Templates: Windows Components","Windows Sandbox: Allow mapping folders into Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowWriteToMappedFolders,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowWriteToMappedFolders,,,,1, +1679,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox,AllowNetworking,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsSandbox,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsSandbox,AllowNetworking,,,,, +1557,"Administrative Templates: Windows Components","Windows Update: Configure Automatic Updates: Configure automatic updating",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,AUOptions,,,,,,,, +732,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoRebootWithLoggedOnUsers,,,,,,,0, +730,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,NoAutoUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowAutoUpdate,,,,0, +731,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\Au,ScheduledInstallDay,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ScheduledInstallDay,,,,, +1813,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Enable features introduced via servicing that are off by default",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,AllowTemporaryEnterpriseFeatureControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowTemporaryEnterpriseFeatureControl,,,,, +733,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetDisablePauseUXAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,SetDisablePauseUXAccess,,,,, +1814,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Enable optional updates",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,SetAllowOptionalContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,AllowOptionalContent,,,,, +723,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuilds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,, +724,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,ManagePreviewBuildsPolicyValue,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,ManagePreviewBuilds,,,,, +726,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,BranchReadinessLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,BranchReadinessLevel,,,,, +725,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,, +727,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferFeatureUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferFeatureUpdatesPeriodInDays,,,,, +728,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdates,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,PauseQualityUpdates,,,,, +729,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,DeferQualityUpdatesPeriodInDays,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Update,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update,DeferQualityUpdatesPeriodInDays,,,,, +78,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +524,"Advanced Audit Policy Configuration","Application Group Management",auditpol,{0CCE9239-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +89,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +90,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +526,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +779,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +72,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +75,"Advanced Audit Policy Configuration","DPAPI Activity",auditpol,{0CCE922D-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +83,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +782,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +783,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,, +780,"Advanced Audit Policy Configuration","Distribution Group Management",auditpol,{0CCE9238-69AE-11D9-BED3-505054503030},,,,,,,,,, +84,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +79,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing", +527,"Advanced Audit Policy Configuration","IPsec Driver",auditpol,{0CCE9213-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +777,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +778,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +85,"Advanced Audit Policy Configuration","Kernel Object",auditpol,{0CCE921F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +525,"Advanced Audit Policy Configuration",Logoff,auditpol,{0CCE9216-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +80,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure", +91,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +781,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,, +81,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +86,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +92,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +94,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure", +76,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing", +77,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +87,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +88,"Advanced Audit Policy Configuration",SAM,auditpol,{0CCE9220-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +73,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +95,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +96,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +93,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing", +82,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +97,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure", +74,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success, +1,Features,"SMBv1 Support",WindowsOptionalFeature,smb1protocol,,,,,,,,,Disabled, +1910,"MS Security Guide","Add Extended Protection for LDAP Authentication (Domain Controllers only)",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,, +537,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,, +790,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,0, +1696,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,, +538,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1, +539,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1, +1801,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,, +1912,"MS Security Guide","Enable Certificate Padding (32-bit subsystem on 64-bit OS)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,, +540,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0, +791,"MS Security Guide","Extended Protection for LDAP Authentication (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1, +270,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,, +1652,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,, +271,"MS Security Guide","Lsass.exe audit mode",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe",AuditLevel,,,,,,,, +1715,"MS Security Guide","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,,,,,,,, +272,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0, +1324,"MS Security Guide","Remove ""Run As Different User"" from context menus (batfile)",Registry,,HKLM:\SOFTWARE\Classes\batfile\shell\runasuser," SuppressionPolicy",,,,,,,, +1325,"MS Security Guide","Remove ""Run As Different User"" from context menus (cmdfile)",Registry,,HKLM:\SOFTWARE\Classes\cmdfile\shell\runasuser," SuppressionPolicy",,,,,,,, +1326,"MS Security Guide","Remove ""Run As Different User"" from context menus (exefile)",Registry,,HKLM:\SOFTWARE\Classes\exefile\shell\runasuser," SuppressionPolicy",,,,,,,, +1327,"MS Security Guide","Remove ""Run As Different User"" from context menus (mscfile)",Registry,,HKLM:\SOFTWARE\Classes\mscfile\shell\runasuser," SuppressionPolicy",,,,,,,, +273,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0, +541,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AutoAdminLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_AutoAdminLogon,,,,0, +542,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0, +543,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1, +544,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters,DisableSavePassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_DisableSavePassword,,,,, +1547,"MSS (Legacy)","MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableDeadGWDetect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_EnableDeadGWDetect,,,,, +545,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1, +546,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_KeepAliveTime,,,,7200000, +547,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0, +548,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_PerformRouterDiscovery,,,,0, +274,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0, +549,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",ScreenSaverGracePeriod,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_ScreenSaverGracePeriod,,,,5, +550,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissionsIPv6,,,,5, +551,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_TcpMaxDataRetransmissions,,,,5, +552,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security,WarningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_WarningLevel,,,,0, +685,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AuditApplicationGuard,,,,, +686,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowCameraMicrophoneRedirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowCameraMicrophoneRedirection,,,,, +687,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowPersistence,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,AllowPersistence,,,,, +688,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,SaveFilesToHost,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,SaveFilesToHost,,,,, +1314,"Microsoft Defender Application Guard","Allow users to trust files that open in Windows Defender Application Guard",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,FileTrustCriteria,,,,,,,, +689,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AppHVSIClipboardSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AuditApplicationGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AuditApplicationGuard,ClipboardSettings,,,,, +1306,"Microsoft Defender Application Guard","Support for Microsoft Defender Application Guard",WindowsOptionalFeature,Windows-Defender-ApplicationGuard,,,,,,,,,Disabled, +690,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\AppHVSI,AllowAppHVSI_ProviderSet,,,,,,,, +1362,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ChildProcess/OverrideChildProcess,,,,,,,,,, +1352,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ChildProcess/OverrideChildProcess,,,,,,,,,, +248,"Microsoft Defender Exploit Guard","Exploit protection: Control flow guard (CFG)",Processmitigation,Cfg.Enable,,,,,,,,,On, +249,"Microsoft Defender Exploit Guard","Exploit protection: Data Execution Prevention (DEP)",Processmitigation,DEP.Enable,,,,,,,,,On, +1372,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/ASLR/ForceRelocateImages,,,,,,,,,, +1364,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/ASLR/ForceRelocateImages,,,,,,,,,, +1381,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1354,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1397,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1426,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1434,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1442,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1334,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1457,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1472,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1480,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1488,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1496,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1504,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/ASLR/ForceRelocateImages,,,,,,,,,, +1343,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (firefox.exe)",ProcessmitigationApplication,firefox.exe/ASLR/ForceRelocateImages,,,,,,,,,, +1389,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/ASLR/ForceRelocateImages,,,,,,,,,, +252,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.ForceRelocateImages,,,,,,,,,Off, +256,"Microsoft Defender Exploit Guard","Exploit protection: High-entropy ASLR",Processmitigation,ASLR.HighEntropy,,,,,,,,,On, +1361,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,, +1341,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,, +1350,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/ImageLoad/OverrideBlockRemoteImageLoads,,,,,,,,,, +250,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP)",Processmitigation,DEP.OverrideDEP,,,,,,,,,False, +1371,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/DEP/OverrideDEP,,,,,,,,,, +1363,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/DEP/OverrideDEP,,,,,,,,,, +1380,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/DEP/OverrideDEP,,,,,,,,,, +1353,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/DEP/OverrideDEP,,,,,,,,,, +1396,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/DEP/OverrideDEP,,,,,,,,,, +1425,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/DEP/OverrideDEP,,,,,,,,,, +1433,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/DEP/OverrideDEP,,,,,,,,,, +1441,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/DEP/OverrideDEP,,,,,,,,,, +1449,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/DEP/OverrideDEP,,,,,,,,,, +1332,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/DEP/OverrideDEP,,,,,,,,,, +1456,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/DEP/OverrideDEP,,,,,,,,,, +1471,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/DEP/OverrideDEP,,,,,,,,,, +1479,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/DEP/OverrideDEP,,,,,,,,,, +1487,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/DEP/OverrideDEP,,,,,,,,,, +1495,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/DEP/OverrideDEP,,,,,,,,,, +1503,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/DEP/OverrideDEP,,,,,,,,,, +1379,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (chrome.exe)",ProcessmitigationApplication,chrome.exe/DEP/OverrideDEP,,,,,,,,,, +1342,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (firefox.exe)",ProcessmitigationApplication,firefox.exe/DEP/OverrideDEP,,,,,,,,,, +1351,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/DEP/OverrideDEP,,,,,,,,,, +1388,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/DEP/OverrideDEP,,,,,,,,,, +1404,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (java.exe)",ProcessmitigationApplication,java.exe/DEP/OverrideDEP,,,,,,,,,, +1411,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaw.exe)",ProcessmitigationApplication,javaw.exe/DEP/OverrideDEP,,,,,,,,,, +1418,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaws.exe)",ProcessmitigationApplication,javaws.exe/DEP/OverrideDEP,,,,,,,,,, +1464,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/DEP/OverrideDEP,,,,,,,,,, +1511,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/DEP/OverrideDEP,,,,,,,,,, +1518,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/DEP/OverrideDEP,,,,,,,,,, +1333,"Microsoft Defender Exploit Guard","Exploit protection: Override Relocate Images (ASLR) (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/ASLR/OverrideForceRelocateImages,,,,,,,,,, +253,"Microsoft Defender Exploit Guard","Exploit protection: Override force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.OverrideForceRelocateImages,,,,,,,,,False, +257,"Microsoft Defender Exploit Guard","Exploit protection: Override high-entropy ASLR",Processmitigation,ASLR.OverrideHighEntropy,,,,,,,,,False, +255,"Microsoft Defender Exploit Guard","Exploit protection: Override randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.OverrideBottomUp,,,,,,,,,False, +260,"Microsoft Defender Exploit Guard","Exploit protection: Override validate exception chains (SEHOP)",Processmitigation,SEHOP.OverrideSEHOP,,,,,,,,,False, +262,"Microsoft Defender Exploit Guard","Exploit protection: Override validate heap integrity",Processmitigation,HEAP.OverrideHEAP,,,,,,,,,False, +1373,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1382,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1398,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1427,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1435,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1443,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1450,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1458,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1473,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1505,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1344,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1390,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1405,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1412,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1419,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1465,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1512,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1519,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1374,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1366,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1383,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1356,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1399,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1428,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1436,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1444,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1451,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1336,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1459,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1474,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1482,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1490,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1498,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1506,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1391,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1406,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1413,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1420,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1466,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1513,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1520,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableExportAddressFilterPlus,,,,,,,,,, +1481,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1489,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1497,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableExportAddressFilter,,,,,,,,,, +1375,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1384,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1400,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1429,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1437,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1445,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1452,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1460,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1475,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1483,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1491,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1499,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1507,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1346,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1392,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1407,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1414,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1421,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1467,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1514,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1521,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableImportAddressFilter,,,,,,,,,, +1377,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1369,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1386,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1402,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1431,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1439,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1447,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1454,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1462,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1477,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1485,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1493,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1501,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1509,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1348,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1394,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1409,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1416,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1423,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1469,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1516,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1523,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopCallerCheck,,,,,,,,,, +1378,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1370,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1387,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1360,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1403,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1432,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1440,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1448,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1455,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1340,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1463,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1478,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1486,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1494,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1502,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1510,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1395,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1410,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1417,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1424,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1470,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1517,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1524,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopSimExec,,,,,,,,,, +1376,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (AcroRd32.exe)",ProcessmitigationApplication,AcroRd32.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1368,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (Acrobat.exe)",ProcessmitigationApplication,Acrobat.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1385,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (EXCEL.EXE)",ProcessmitigationApplication,EXCEL.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1358,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (GROOVE.EXE)",ProcessmitigationApplication,GROOVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1401,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (INFOPATH.EXE)",ProcessmitigationApplication,INFOPATH.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1430,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (LYNC.EXE)",ProcessmitigationApplication,LYNC.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1438,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSACCESS.EXE)",ProcessmitigationApplication,MSACCESS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1446,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSPUB.EXE)",ProcessmitigationApplication,MSPUB.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1453,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OIS.EXE)",ProcessmitigationApplication,OIS.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1338,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (ONEDRIVE.EXE)",ProcessmitigationApplication,ONEDRIVE.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1461,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OUTLOOK.EXE)",ProcessmitigationApplication,OUTLOOK.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1476,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (POWERPNT.EXE)",ProcessmitigationApplication,POWERPNT.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1484,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (PPTVIEW.EXE)",ProcessmitigationApplication,PPTVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1492,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VISIO.EXE)",ProcessmitigationApplication,VISIO.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1500,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VPREVIEW.EXE)",ProcessmitigationApplication,VPREVIEW.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1508,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (WINWORD.EXE)",ProcessmitigationApplication,WINWORD.EXE/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (fltldr.exe)",ProcessmitigationApplication,fltldr.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1393,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (iexplore.exe)",ProcessmitigationApplication,iexplore.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1408,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (java.exe)",ProcessmitigationApplication,java.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1415,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaw.exe)",ProcessmitigationApplication,javaw.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1422,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaws.exe)",ProcessmitigationApplication,javaws.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1468,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (plugin-container.exe)",ProcessmitigationApplication,plugin-container.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1515,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wmplayer.exe)",ProcessmitigationApplication,wmplayer.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +1522,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wordpad.exe)",ProcessmitigationApplication,wordpad.exe/Payload/OverrideEnableRopStackPivot,,,,,,,,,, +254,"Microsoft Defender Exploit Guard","Exploit protection: Randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.BottomUp,,,,,,,,,On, +259,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP (Telemetry only)",Processmitigation,SEHOP.TelemetryOnly,,,,,,,,,NOTSET, +258,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP)",Processmitigation,SEHOP.Enable,,,,,,,,,On, +261,"Microsoft Defender Exploit Guard","Exploit protection: Validate heap integrity",Processmitigation,HEAP.TerminateOnError,,,,,,,,,On, +251,"Microsoft Defender Exploit Guard","Force use of Data Execution Prevention (DEP)",bcdedit,nx,,,,,,,,,OptIn, +1331,"Microsoft Defender Exploit Guard","Use a common set of exploit protection settings",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection",ExploitProtectionSettings,,,,,,,, +1000,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,, +1001,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,, +1002,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,, +1003,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,, +1004,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,, +1005,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,, +1006,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,, +1007,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,, +1008,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,, +1093,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,, +1090,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,, +1091,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,, +1092,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,, +1096,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,, +1097,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,, +1099,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,, +1098,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,, +1102,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,, +1095,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,, +1094,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,, +1100,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,, +1101,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,, +1103,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,, +1107,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,, +1104,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,, +1105,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,, +1106,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,, +1110,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,, +1111,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,, +1113,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,, +1112,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,, +1116,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,, +1109,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,, +1108,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,, +1114,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,, +1115,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,, +1117,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,, +1121,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,, +1118,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,, +1119,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,, +1120,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,, +1124,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,, +1125,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,, +1127,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,, +1126,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,, +1130,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,, +1123,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,, +1122,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,, +1128,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,, +1129,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,, +1131,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,, +1135,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,, +1132,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,, +1133,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,, +1134,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,, +1138,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,, +1139,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,, +1141,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,, +1140,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,, +1144,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,, +1137,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,, +1136,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,, +1142,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,, +1143,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,, +1145,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,, +1149,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,, +1146,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,, +1147,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,, +1148,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,, +1152,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,, +1153,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,, +1155,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,, +1154,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,, +1158,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,, +1151,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,, +1150,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,, +1156,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,, +1157,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,, +1159,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,, +1163,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,, +1160,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,, +1161,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,, +1162,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,, +1166,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,, +1167,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,, +1169,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,, +1168,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,, +1172,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,, +1165,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,, +1164,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,, +1170,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,, +1171,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,, +1173,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,, +1177,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,, +1174,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,, +1175,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,, +1176,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,, +1180,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,, +1181,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,, +1183,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,, +1182,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,, +1186,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,, +1179,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,, +1178,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,, +1184,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,, +1185,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,, +1187,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,, +1191,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,, +1188,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,, +1189,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,, +1190,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,, +1194,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,, +1195,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,, +1197,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,, +1196,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,, +1200,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,, +1193,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,, +1192,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,, +1198,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,, +1199,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,, +1201,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,, +1205,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,, +1202,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,, +1203,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,, +1204,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,, +1208,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,, +1209,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,, +1211,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,, +1210,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,, +1214,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,, +1207,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,, +1206,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,, +1212,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,, +1213,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,, +1215,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,, +1219,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,, +1216,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,, +1217,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,, +1218,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,, +1222,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,, +1223,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,, +1225,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,, +1224,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,, +1228,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,, +1221,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,, +1220,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,, +1226,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,, +1227,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,, +1229,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,, +1233,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,, +1230,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,, +1231,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,, +1232,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,, +1236,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,, +1237,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,, +1239,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,, +1238,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,, +1242,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,, +1235,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,, +1234,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,, +1240,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,, +1241,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,, +1243,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,, +1247,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,, +1244,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,, +1245,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,, +1246,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,, +1250,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,, +1251,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,, +1253,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,, +1252,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,, +1256,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,, +1249,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,, +1248,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,, +1254,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,, +1255,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,, +1257,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,, +1261,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,, +1258,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,, +1259,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,, +1260,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,, +1264,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,, +1265,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,, +1267,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,, +1266,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,, +1270,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,, +1263,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,, +1262,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,, +1268,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,, +1269,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,, +1271,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,, +1272,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,, +968,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,, +965,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,, +966,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,, +967,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2, +1868,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequirelmtrustedpublisher,,,,,,,, +1869,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1302,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,, +311,"Office 2016 / Office 365","Microsoft Excel: Allow DDE",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0, +999,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,, +993,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,, +309,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0, +970,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,, +1779,"Office 2016 / Office 365","Microsoft Excel: Block Excel XLL Add-ins that come from an untrusted source",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,blockxllfrominternet,,,,,,,, +315,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0, +972,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,, +978,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,, +994,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,, +995,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,, +973,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,, +969,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,, +310,"Office 2016 / Office 365","Microsoft Excel: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DontUpdateLinks,,,,,,,0, +313,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0, +312,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0, +1689,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDEAllowed)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDEAllowed,,,,,,,1, +314,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDECleaned)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDECleaned,,,,,,,0, +980,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,, +981,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,, +982,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,, +983,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,, +984,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,, +985,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,, +986,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,, +987,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,, +988,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,, +989,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,, +990,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,, +1919,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: File Block includes external link files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,fileblockexternallinks,,,,,,,, +991,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,, +992,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,, +979,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,, +974,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,, +971,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,, +1660,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,, +1783,"Office 2016 / Office 365","Microsoft Excel: Python Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,PythonFunctionWarnings,,,,,,,, +1297,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,, +975,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,, +997,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,, +996,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,, +998,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,, +976,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,, +316,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2, +317,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2, +1870,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequirelmtrustedpublisher,,,,,,,, +1880,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Enable Excel 4.0 macros when VBA macros are enabled",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrowarningfollowvba,,,,,,,, +1871,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1299,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,, +977,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,, +318,"Office 2016 / Office 365","Microsoft OneNote: Disable embedded files",Registry,,HKCU:\Software\Microsoft\Office\16.0\OneNote\Options,DisableEmbeddedFiles,,,,,,,0, +1025,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,, +1045,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,, +1037,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,, +1033,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,, +1019,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,, +1039,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,, +1040,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,, +1041,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,, +1042,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,, +1043,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,, +1044,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,, +1034,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,, +1021,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,, +1022,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,, +1028,"Office 2016 / Office 365","Microsoft Outlook: Do not display 'Publish to GAL' button",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publishtogaldisabled,,,,,,,, +1020,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,, +1917,"Office 2016 / Office 365","Microsoft Outlook: Folder Home Pages for Outlook Special Folders: Do not allow Home Page URL to be set in folder Properties",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\webview,disable,,,,,,,, +1027,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,, +1024,"Office 2016 / Office 365","Microsoft Outlook: Junk E-mail protection level",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailprotection,,,,,,,, +1029,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,, +1032,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,, +1918,"Office 2016 / Office 365","Microsoft Outlook: Outlook Today Settings: Outlook Today availability",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\today,disable,,,,,,,, +1026,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,, +1035,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,, +1036,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,, +1031,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,, +1046,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,, +1038,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,, +1030,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,, +1023,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,, +1058,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,, +319,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0, +1050,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,, +1053,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,, +1054,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,, +1924,"Office 2016 / Office 365","Microsoft PowerPoint: OLE Active Content",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,enableoleactions,,,,,,,, +1051,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,, +1298,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,, +1047,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,, +1048,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,, +1052,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,, +1056,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,, +1055,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,, +1057,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,, +1049,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,, +320,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2, +1872,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequirelmtrustedpublisher,,,,,,,, +1873,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1300,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,, +1059,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,, +1881,"Office 2016 / Office 365","Microsoft Project: Block macros from running in Office files from the internet",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",blockcontentexecutionfrominternet,,,,,,,, +1060,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,, +1292,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,, +1061,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2, +1303,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbadigsigtrustedpublishers,,,,,,,, +1781,"Office 2016 / Office 365","Microsoft Publisher: Block macros from running in Office files from the internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,blockcontentexecutionfrominternet,,,,,,,, +1063,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,, +1062,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,, +1293,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,, +1064,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2, +1874,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequirelmtrustedpublisher,,,,,,,, +1875,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1304,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,, +1065,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,, +1066,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,, +1067,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,, +1069,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,, +1070,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,, +1071,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,, +1294,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,, +1068,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2, +1876,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequirelmtrustedpublisher,,,,,,,, +1877,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1305,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,, +322,"Office 2016 / Office 365","Microsoft Word (Mail): Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options\WordMail,DontUpdateLinks,,,,,,,0, +1089,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,, +323,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0, +1073,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,, +1084,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,, +1085,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,, +321,"Office 2016 / Office 365","Microsoft Word: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options,DontUpdateLinks,,,,,,,0, +1295,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0, +1075,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,, +1076,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,, +1077,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,, +1078,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,, +1079,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,, +1080,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,, +1081,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,, +1082,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,, +1083,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,, +1296,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,, +1074,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,, +1087,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,, +1086,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,, +1088,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,, +1072,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,, +324,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2, +325,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2, +1878,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequirelmtrustedpublisher,,,,,,,, +1879,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequiredigsigwithcodesigningeku,,,,,,,, +1301,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,, +1284,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,, +1276,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,, +1279,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,, +1283,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,, +1278,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,, +1281,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,, +1277,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,, +1280,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,, +1282,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,, +1009,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,, +1782,"Office 2016 / Office 365","Security Settings: Allow Basic Authentication prompts from network proxies",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\identity,basicauthproxybehavior,,,,,,,, +1285,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,, +1016,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,, +1290,"Office 2016 / Office 365","Security Settings: Application Guard: Prevent users from removing Application Guard protection on files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security\applicationguard,disabletrustpromotion,,,,,,,, +1291,"Office 2016 / Office 365","Security Settings: Application Guard: Turn off protection of unsupported file types in Application Guard for Office",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security\applicationguard,redirectunsupportedfiletypestopv,,,,,,,, +1010,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,, +1920,"Office 2016 / Office 365","Security Settings: Block Insecure Protocols",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\fileio,blockinsecureprotocols,,,,,,,, +1921,"Office 2016 / Office 365","Security Settings: Block OLE Graph",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,blockolegraph,,,,,,,, +1922,"Office 2016 / Office 365","Security Settings: Block OrgChart",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,blockorgchart,,,,,,,, +1286,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,, +1287,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,, +1018,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,, +1288,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,, +1011,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,, +1017,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,, +1780,"Office 2016 / Office 365","Security Settings: Encryption mode for Information Rights Management (IRM)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\drm,compatibleencryption,,,,,,,, +1012,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,, +1013,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,, +1014,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,, +308,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,0, +1289,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,, +1015,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,, +1923,"Office 2016 / Office 365","Security Settings: Restrict Apps from FPRPC Fallback",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\fileio,blockwecfallback,,,,,,,, +1273,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,, +1274,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,, +330,"Office 365","Allow the use of additional optional connected experiences",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,controllerconnectedservicesenabled,,,,,,,, +327,"Office 365","Allow the use of connected experiences in Office",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,disconnectedstate,,,,,,,, +328,"Office 365","Allow the use of connected experiences that analyze content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,usercontentdisabled,,,,,,,, +329,"Office 365","Allow the use of connected experiences that download online content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,downloadcontentdisabled,,,,,,,, +331,"Office 365","Configure the level of client software diagnostic data sent by Office to Microsoft",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,sendtelemetry,,,,,,,, +326,"Office 365","Disable the Office 365 Telemetry module",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,DisableTelemetry,,,,,,,, +1600,"Schannel: TLS Settings: Ciphers","AES 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128",Enabled,,,,,,,, +1601,"Schannel: TLS Settings: Ciphers","AES 256/256",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256",Enabled,,,,,,,, +1591,"Schannel: TLS Settings: Ciphers","DES 56/56",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56",Enabled,,,,,,,, +1590,"Schannel: TLS Settings: Ciphers",NULL,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL,Enabled,,,,,,,, +1594,"Schannel: TLS Settings: Ciphers","RC2 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128",Enabled,,,,,,,, +1592,"Schannel: TLS Settings: Ciphers","RC2 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128",Enabled,,,,,,,, +1593,"Schannel: TLS Settings: Ciphers","RC2 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128",Enabled,,,,,,,, +1598,"Schannel: TLS Settings: Ciphers","RC4 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128",Enabled,,,,,,,, +1595,"Schannel: TLS Settings: Ciphers","RC4 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128",Enabled,,,,,,,, +1596,"Schannel: TLS Settings: Ciphers","RC4 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128",Enabled,,,,,,,, +1597,"Schannel: TLS Settings: Ciphers","RC4 64/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128",Enabled,,,,,,,, +1599,"Schannel: TLS Settings: Ciphers","Triple DES 168",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168",Enabled,,,,,,,, +1603,"Schannel: TLS Settings: Hashes",MD5,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5,Enabled,,,,,,,, +1604,"Schannel: TLS Settings: Hashes",SHA-1,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA,Enabled,,,,,,,, +1605,"Schannel: TLS Settings: Hashes",SHA-256,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256,Enabled,,,,,,,, +1606,"Schannel: TLS Settings: Hashes",SHA-384,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384,Enabled,,,,,,,, +1607,"Schannel: TLS Settings: Hashes",SHA-512,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512,Enabled,,,,,,,, +1608,"Schannel: TLS Settings: KeyExchangeAlgorithms",Diffie-Hellman,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,Enabled,,,,,,,, +1610,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ClientMinKeyBitLength,,,,,,,, +1609,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ServerMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ServerMinKeyBitLength,,,,,,,, +1611,"Schannel: TLS Settings: KeyExchangeAlgorithms",ECDH,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH,Enabled,,,,,,,, +1612,"Schannel: TLS Settings: KeyExchangeAlgorithms",PKCS,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,Enabled,,,,,,,, +1613,"Schannel: TLS Settings: KeyExchangeAlgorithms","PKCS (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,ClientMinKeyBitLength,,,,,,,, +1564,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Enabled,,,,,,,, +1565,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Disabledbydefault,,,,,,,, +1568,"Schannel: TLS Settings: Protocols","Client: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Enabled,,,,,,,, +1569,"Schannel: TLS Settings: Protocols","Client: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Disabledbydefault,,,,,,,, +1572,"Schannel: TLS Settings: Protocols","Client: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Enabled,,,,,,,, +1573,"Schannel: TLS Settings: Protocols","Client: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Disabledbydefault,,,,,,,, +1576,"Schannel: TLS Settings: Protocols","Client: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Enabled,,,,,,,, +1577,"Schannel: TLS Settings: Protocols","Client: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Disabledbydefault,,,,,,,, +1580,"Schannel: TLS Settings: Protocols","Client: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Enabled,,,,,,,, +1581,"Schannel: TLS Settings: Protocols","Client: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Disabledbydefault,,,,,,,, +1584,"Schannel: TLS Settings: Protocols","Client: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Enabled,,,,,,,, +1585,"Schannel: TLS Settings: Protocols","Client: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Disabledbydefault,,,,,,,, +1588,"Schannel: TLS Settings: Protocols","Client: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Enabled,,,,,,,, +1589,"Schannel: TLS Settings: Protocols","Client: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Disabledbydefault,,,,,,,, +1624,"Schannel: TLS Settings: Protocols","Client: TLSv1.3",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client",Enabled,,,,,,,, +1625,"Schannel: TLS Settings: Protocols","Client: TLSv1.3 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client",Disabledbydefault,,,,,,,, +1562,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Enabled,,,,,,,, +1563,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Disabledbydefault,,,,,,,, +1566,"Schannel: TLS Settings: Protocols","Server: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Enabled,,,,,,,, +1567,"Schannel: TLS Settings: Protocols","Server: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Disabledbydefault,,,,,,,, +1570,"Schannel: TLS Settings: Protocols","Server: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Enabled,,,,,,,, +1571,"Schannel: TLS Settings: Protocols","Server: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Disabledbydefault,,,,,,,, +1574,"Schannel: TLS Settings: Protocols","Server: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Enabled,,,,,,,, +1575,"Schannel: TLS Settings: Protocols","Server: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Disabledbydefault,,,,,,,, +1578,"Schannel: TLS Settings: Protocols","Server: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Enabled,,,,,,,, +1579,"Schannel: TLS Settings: Protocols","Server: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Disabledbydefault,,,,,,,, +1582,"Schannel: TLS Settings: Protocols","Server: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Enabled,,,,,,,, +1583,"Schannel: TLS Settings: Protocols","Server: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Disabledbydefault,,,,,,,, +1586,"Schannel: TLS Settings: Protocols","Server: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Enabled,,,,,,,, +1587,"Schannel: TLS Settings: Protocols","Server: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Disabledbydefault,,,,,,,, +1622,"Schannel: TLS Settings: Protocols","Server: TLSv1.3",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server",Enabled,,,,,,,, +1623,"Schannel: TLS Settings: Protocols","Server: TLSv1.3 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server",Disabledbydefault,,,,,,,, +1714,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready, +379,"Security Options","Accounts: Administrator account status",localaccount,500,,,,,,,,,False, +765,"Security Options","Accounts: Administrator account status (Member)",localaccount,500,,,,,,,,,True, +12,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0, +380,"Security Options","Accounts: Guest account status",localaccount,501,,,,,,,,,False, +766,"Security Options","Accounts: Guest account status (Member)",localaccount,501,,,,,,,,,False, +381,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1, +382,"Security Options","Accounts: Rename administrator account",localaccount,500,,,,,,,,,Administrator, +383,"Security Options","Accounts: Rename guest account",localaccount,501,,,,,,,,,Guest, +13,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1, +384,"Security Options","Audit: Shut down system immediately if unable to log security audits",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,CrashOnAuditFail,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ShutdownSystemImmediatelyIfUnableToLogSecurityAudits,,,,0, +385,"Security Options","Devices: Allowed to format and eject removable media",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",AllocateDASD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_AllowedToFormatAndEjectRemovableMedia,,,,2, +386,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0, +767,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,SubmitControl,,,,,,,0, +1320,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,VulnerableChannelAllowList,,,,,,,, +961,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1, +768,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1, +1867,"Security Options","Domain controller: LDAP server signing requirements Enforcement",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerEnforceIntegrity,,,,,,,, +769,"Security Options","Domain controller: Refuse machine account password changes (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters,RefusePasswordChange,,,,,,,1, +387,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1, +388,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1, +389,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1, +390,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0, +391,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30, +392,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1, +14,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1, +15,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0, +16,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0, +393,"Security Options","Interactive logon: Machine account lockout threshold",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,MaxDevicePasswordFailedAttempts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineAccountLockoutThreshold,,,,10, +394,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900, +395,"Security Options","Interactive logon: Message text for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeText,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTextForUsersAttemptingToLogOn,,,,, +396,"Security Options","Interactive logon: Message title for users attempting to log on",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LegalNoticeCaption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MessageTitleForUsersAttemptingToLogOn,,,,, +397,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",CachedLogonsCount,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_NumberOfPreviousLogonsToCache,,,,10, +398,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5, +399,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",PasswordExpiryWarning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_PromptUserToChangePasswordBeforeExpiration,,,,5, +770,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ForceUnlockLogon,,,,,,,0, +400,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0, +17,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0, +18,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1, +401,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0, +402,"Security Options","Microsoft network server: Amount of idle time required before suspending session",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession,,,,15, +19,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0, +20,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0, +403,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,enableforcedlogoff,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DisconnectClientsWhenLogonHoursExpire,,,,1, +404,"Security Options","Microsoft network server: Server SPN target name validation level",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,, +771,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,SMBServerNameHardeningLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_ServerSPNTargetNameValidationLevel,,,,0, +405,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0, +21,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1, +772,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1, +22,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0, +773,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0, +23,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0, +406,"Security Options","Network access: Let Everyone permissions apply to anonymous users",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,EveryoneIncludesAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers,,,,0, +407,"Security Options","Network access: Named Pipes that can be accessed anonymously",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,, +774,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,, +775,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,NullSessionPipes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_NamedPipesThatCanBeAccessedAnonymously,,,,, +408,"Security Options","Network access: Remotely accessible registry paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPaths,,,,"System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion", +409,"Security Options","Network access: Remotely accessible registry paths and sub-paths",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RemotelyAccessibleRegistryPathsAndSubpaths,,,,"System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLog", +410,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1, +411,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,, +776,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,, +412,"Security Options","Network access: Shares that can be accessed anonymously",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharesThatCanBeAccessedAnonymously,,,,, +413,"Security Options","Network access: Sharing and security model for local accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,ForceGuest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_SharingAndSecurityModelForLocalAccounts,,,,0, +414,"Security Options","Network security: Allow Local System to use computer identity for NTLM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,UseMachineId,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM,,,,0, +24,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0, +416,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\pku2u,AllowOnlineID,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowPKU2UAuthenticationRequests,,,,, +417,"Security Options","Network security: Configure encryption types allowed for Kerberos",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes,,,,,,,2147483644, +418,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1, +419,"Security Options","Network security: Force logoff when logon hours expires",secedit,"System Access\ForceLogoffWhenHourExpire",,,,,,,,,0, +25,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3, +1882,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1, +26,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1, +27,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912, +28,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912, +29,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0, +30,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0, +1800,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0, +1558,"Security Options","Network security: Restrict NTLM: Incoming NTLM traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic,,,,, +31,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0, +32,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1, +420,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography,ForceKeyProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemCryptography_ForceStrongKeyProtection,,,,, +1321,"Security Options","System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy,Enabled,,,,,,,, +421,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel",ObCaseInsensitive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems,,,,1, +422,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1, +1559,"Security Options","System settings: Optional subsystems",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager\Subsystems",Optional,,,,,,,, +33,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0, +1537,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableUIADesktopToggle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_AllowUIAccessApplicationsToPromptForElevation,,,,, +34,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5, +1827,"Security Options","User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorEnhancedAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection,,,,, +35,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0, +1828,"Security Options","User Account Control: Configure type of Admin Approval Mode Admin approval mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,TypeOfAdminApprovalMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_TypeOfAdminApprovalMode,,,,, +423,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1, +424,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1, +425,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1, +426,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation,,,,1, +427,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1, +428,"System Services","Bluetooth Audio Gateway Service (BTAGService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\BTAGService,Start,,,,,,,3, +429,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",service,BTAGService,,,,,,,,,Manual, +430,"System Services","Bluetooth Support Service (bthserv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\bthserv,Start,,,,,,,3, +431,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",service,bthserv,,,,,,,,,Manual, +432,"System Services","Computer Browser (Browser)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Browser,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureComputerBrowserServiceStartupMode,,,,, +433,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",service,Browser,,,,,,,,,Manual, +1560,"System Services","Diagnostics Tracking Service (DiagTrack)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\DiagTrack,Start,,,,,,,2, +1561,"System Services","Diagnostics Tracking Service (DiagTrack) (Service Startup type)",service,DiagTrack,,,,,,,,,Automatic, +1778,"System Services","Disable mDNS in Dnscache service",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters,EnableMDNS,,,,,,,, +434,"System Services","Downloaded Maps Manager (MapsBroker)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MapsBroker,Start,,,,,,,2, +435,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",service,MapsBroker,,,,,,,,,Automatic, +1885,"System Services","GameInput Service (GameInputSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\GameInputSvc,Start,,,,,,,3, +1886,"System Services","GameInput Service (GameInputSvc) (Service Startup type)",service,GameInputSvc,,,,,,,,,Manual, +436,"System Services","Geolocation Service (lfsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lfsvc,Start,,,,,,,3, +437,"System Services","Geolocation Service (lfsvc) (Service Startup type)",service,lfsvc,,,,,,,,,Manual, +438,"System Services","IIS Admin Service (IISADMIN)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\IISADMIN,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureIISAdminServiceStartupMode,,,,, +439,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",service,IISADMIN,,,,,,,,,"", +440,"System Services","Infrared monitor service (irmon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\irmon,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInfraredMonitorServiceStartupMode,,,,, +441,"System Services","Infrared monitor service (irmon) (Service Startup type)",service,irmon,,,,,,,,,, +442,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureInternetConnectionSharingServiceStartupMode,,,,3, +443,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",service,SharedAccess,,,,,,,,,Manual, +444,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\lltdsvc,Start,,,,,,,3, +445,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",service,lltdsvc,,,,,,,,,Manual, +446,"System Services","LxssManager (LxssManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LxssManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureLxssManagerServiceStartupMode,,,,"", +447,"System Services","LxssManager (LxssManager) (Service Startup type)",service,LxssManager,,,,,,,,,, +448,"System Services","Microsoft FTP Service (FTPSVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\FTPSVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureMicrosoftFTPServiceStartupMode,,,,, +449,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",service,FTPSVC,,,,,,,,,"", +1315,"System Services","Microsoft Store Install Service (InstallService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\InstallService,Start,,,,,,,3, +1316,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",service,InstallService,,,,,,,,,Manual, +450,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MSiSCSI,Start,,,,,,,3, +451,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",service,MsiSCSI,,,,,,,,,Manual, +452,"System Services","OpenSSH SSH Server (sshd)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sshd,Start,,,,,,,, +453,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",service,sshd,,,,,,,,,, +460,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPAutoReg,Start,,,,,,,3, +461,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",service,PNRPAutoReg,,,,,,,,,Manual, +454,"System Services","Peer Name Resolution Protocol (PNRPsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PNRPsvc,Start,,,,,,,3, +455,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",service,PNRPsvc,,,,,,,,,Manual, +456,"System Services","Peer Networking Grouping (p2psvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2psvc,Start,,,,,,,3, +457,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",service,p2psvc,,,,,,,,,Manual, +458,"System Services","Peer Networking Identity Manager (p2pimsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\p2pimsvc,Start,,,,,,,3, +459,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",service,p2pimsvc,,,,,,,,,Manual, +1664,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2, +1680,"System Services","Print Spooler (Spooler) (DC only) ",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2, +1682,"System Services","Print Spooler (Spooler) (MS only)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2, +1665,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic, +1681,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",service,Spooler,,,,,,,,,Automatic, +1683,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",service,Spooler,,,,,,,,,Automatic, +462,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\wercplsupport,Start,,,,,,,3, +463,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",service,wercplsupport,,,,,,,,,Manual, +464,"System Services","Remote Access Auto Connection Manager (RasAuto)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RasAuto,Start,,,,,,,3, +465,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",service,RasAuto,,,,,,,,,Manual, +466,"System Services","Remote Desktop Configuration (SessionEnv)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SessionEnv,Start,,,,,,,3, +467,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",service,SessionEnv,,,,,,,,,Manual, +468,"System Services","Remote Desktop Services (TermService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\TermService,Start,,,,,,,3, +469,"System Services","Remote Desktop Services (TermService) (Service Startup type)",service,TermService,,,,,,,,,Manual, +470,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\UmRdpService,Start,,,,,,,3, +471,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",service,UmRdpService,,,,,,,,,Manual, +472,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RpcLocator,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRemoteProcedureCallLocatorServiceStartupMode,,,,3, +473,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",service,RpcLocator,,,,,,,,,Manual, +474,"System Services","Remote Registry (RemoteRegistry)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteRegistry,Start,,,,,,,4, +475,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",service,RemoteRegistry,,,,,,,,,Disabled, +476,"System Services","Routing and Remote Access (RemoteAccess)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureRoutingAndRemoteAccessServiceStartupMode,,,,4, +477,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",service,RemoteAccess,,,,,,,,,Disabled, +482,"System Services","SNMP Service (SNMP)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SNMP,Start,,,,,,,, +483,"System Services","SNMP Service (SNMP) (Service Startup type)",service,SNMP,,,,,,,,,"", +486,"System Services","SSDP Discovery (SSDPSRV)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SSDPSRV,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSSDPDiscoveryServiceStartupMode,,,,3, +487,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",service,SSDPSRV,,,,,,,,,Manual, +1322,"System Services","Secondary Logon (seclogon)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\seclogon,Start,,,,,,,3, +1323,"System Services","Secondary Logon (seclogon) (Service Startup type)",service,seclogon,,,,,,,,,Manual, +478,"System Services","Server (LanmanServer)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer,Start,,,,,,,2, +479,"System Services","Server (LanmanServer) (Service Startup type)",service,LanmanServer,,,,,,,,,Automatic, +480,"System Services","Simple TCP/IP Services (simptcp)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\simptcp,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSimpleTCPIPServicesStartupMode,,,,, +481,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",service,simptcp,,,,,,,,,"", +484,"System Services","Special Administration Console Helper (sacsvr)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\sacsvr,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureSpecialAdministrationConsoleHelperServiceStartupMode,,,,, +485,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",service,sacsvr,,,,,,,,,, +488,"System Services","UPnP Device Host (upnphost)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\upnphost,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureUPnPDeviceHostServiceStartupMode,,,,3, +489,"System Services","UPnP Device Host (upnphost) (Service Startup type)",service,upnphost,,,,,,,,,Manual, +490,"System Services","Web Management Service (WMSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWebManagementServiceStartupMode,,,,, +491,"System Services","Web Management Service (WMSvc) (Service Startup type)",service,WMSvc,,,,,,,,,"", +1745,"System Services","WebClient (WebClient)",Registry,"",HKLM:\SYSTEM\CurrentControlSet\Services\WebClient,Start,,,,,,,3, +1746,"System Services","WebClient (WebClient) (Service Startup type)",service,WebClient,,,,,,,,,Manual, +1883,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc,Start,,,,,,,3, +1884,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Service Startup type)",service,WinHttpAutoProxySvc,,,,,,,,,Manual, +492,"System Services","Windows Error Reporting Service (WerSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc,Start,,,,,,,3, +493,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",service,WerSvc,,,,,,,,,Manual, +494,"System Services","Windows Event Collector (Wecsvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Wecsvc,Start,,,,,,,3, +495,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",service,Wecsvc,,,,,,,,,Manual, +496,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMediaPlayerNetworkSharingServiceStartupMode,,,,3, +497,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",service,WMPNetworkSvc,,,,,,,,,Manual, +498,"System Services","Windows Mobile Hotspot Service (icssvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\icssvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWindowsMobileHotspotServiceStartupMode,,,,3, +499,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",service,icssvc,,,,,,,,,Manual, +500,"System Services","Windows Push Notifications System Service (WpnService)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WpnService,Start,,,,,,,2, +501,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",service,WpnService,,,,,,,,,Automatic, +502,"System Services","Windows PushToInstall Service (PushToInstall)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\PushToInstall,Start,,,,,,,3, +503,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",service,PushToInstall,,,,,,,,,Manual, +504,"System Services","Windows Remote Management (WS-Management) (WinRM)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\WinRM,Start,,,,,,,3, +505,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",service,WinRM,,,,,,,,,Manual, +506,"System Services","World Wide Web Publishing Service (W3SVC)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureWorldWideWebPublishingServiceStartupMode,,,,, +507,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",service,W3SVC,,,,,,,,,, +508,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3, +509,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual, +510,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3, +511,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual, +512,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3, +513,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual, +514,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3, +515,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual, +345,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,, +5,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone", +745,"User Rights Assignment","Access this computer from the network (DC)",accesschk,SeNetworkLogonRight,,,,,,,,,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone", +746,"User Rights Assignment","Access this computer from the network (Member)",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Pre-Windows 2000 Compatible Access;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users;Everyone", +346,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,, +747,"User Rights Assignment","Add workstations to domain (DC)",accesschk,SeMachineAccountPrivilege,,,,,,,,,"NT AUTHORITY\Authenticated Users", +347,"User Rights Assignment","Adjust memory quotas for a process",accesschk,SeIncreaseQuotaPrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +6,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest", +1799,"User Rights Assignment","Allow log on locally (DC only)",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest", +348,"User Rights Assignment","Allow log on through Remote Desktop Services",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators", +748,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators, +749,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators", +349,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators", +350,"User Rights Assignment","Change the system time",accesschk,SeSystemTimePrivilege,,,,,,,,,"BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE", +351,"User Rights Assignment","Change the time zone",accesschk,SeTimeZonePrivilege,,,,,,,,,"BUILTIN\Device Owners;BUILTIN\Users;BUILTIN\Administrators;NT AUTHORITY\LOCAL SERVICE", +352,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators, +353,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,, +354,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +355,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,, +356,"User Rights Assignment","Create symbolic links",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators, +750,"User Rights Assignment","Create symbolic links (DC)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators, +357,"User Rights Assignment","Create symbolic links (Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators, +751,"User Rights Assignment","Create symbolic links (Member)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,BUILTIN\Administrators, +752,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",accesschk,SeCreateSymbolicLinkPrivilege,,,,,,,,,S-1-5-83-0;BUILTIN\Administrators, +7,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators, +8,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest, +753,"User Rights Assignment","Deny access to this computer from the network (DC)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests, +754,"User Rights Assignment","Deny access to this computer from the network (Member)",accesschk,SeDenyNetworkLogonRight,,,,,,,,,BUILTIN\Guests, +9,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,, +10,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,, +358,"User Rights Assignment","Deny log on locally",accesschk,SeDenyInteractiveLogonRight,,,,,,,,,BUILTIN\Guests, +11,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,, +755,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,, +756,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,, +359,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,, +757,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,BUILTIN\Administrators, +758,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",accesschk,SeEnableDelegationPrivilege,,,,,,,,,, +360,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators, +361,"User Rights Assignment","Generate security audits",accesschk,SeAuditPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +362,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +759,"User Rights Assignment","Impersonate a client after authentication (DC)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +760,"User Rights Assignment","Impersonate a client after authentication (Member)",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +363,"User Rights Assignment","Increase scheduling priority",accesschk,SeIncreaseBasePriorityPrivilege,,,,,,,,,"Window Manager\Window Manager Group;BUILTIN\Administrators", +364,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators, +365,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,, +366,"User Rights Assignment","Log on as a batch job",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators", +761,"User Rights Assignment","Log on as a batch job (DC)",accesschk,SeBatchLogonRight,,,,,,,,,"BUILTIN\Performance Log Users;BUILTIN\Backup Operators;BUILTIN\Administrators", +367,"User Rights Assignment","Log on as a service",accesschk,SeServiceLogonRight,,,,,,,,,"NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE", +368,"User Rights Assignment","Log on as a service (Hyper-V)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE", +1804,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",accesschk,SeServiceLogonRight,,,,,,,,,"S-1-5-83-0;NT SERVICE\ALL SERVICES;NT AUTHORITY\NETWORK SERVICE", +369,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators, +763,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators, +762,"User Rights Assignment","Manage auditing and security log (DC)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators, +764,"User Rights Assignment","Manage auditing and security log (Member)",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators, +370,"User Rights Assignment","Modify an object label",accesschk,SeReLabelPrivilege,,,,,,,,,, +371,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators, +372,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators, +373,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators, +374,"User Rights Assignment","Profile system performance",accesschk,SeSystemProfilePrivilege,,,,,,,,,"NT SERVICE\WdiServiceHost;BUILTIN\Administrators", +375,"User Rights Assignment","Replace a process level token",accesschk,SeAssignPrimaryTokenPrivilege,,,,,,,,,"NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE", +376,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators", +377,"User Rights Assignment","Shut down the system",accesschk,SeShutdownPrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators", +800,"User Rights Assignment","Synchronize directory service data (DC)",accesschk,SeSyncAgentPrivilege,,,,,,,,,, +378,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators, +522,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0, +521,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0, +816,"Windows Firewall","Display a notification (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DisableNotifications,,,,,,,0, +516,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0, +817,"Windows Firewall","Display a notification (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DisableNotifications,,,,,,,0, +518,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0, +818,"Windows Firewall","Display a notification (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DisableNotifications,,,,,,,0, +520,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0, +37,"Windows Firewall","EnableFirewall (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,EnableFirewall,,,,,,,1, +36,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0, +49,"Windows Firewall","EnableFirewall (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,EnableFirewall,,,,,,,1, +48,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0, +61,"Windows Firewall","EnableFirewall (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,EnableFirewall,,,,,,,1, +60,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0, +294,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\RunScriptHelper.exe|,,,,,,,,,False, +295,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\RunScriptHelper.exe|,,,,,,,,,False, +275,"Windows Firewall",HardeningKitty-Block-TCP-NetBIOS,FirewallRule,"Any|Inbound|Block|TCP|137,138,139||",,,,,,,,,False, +276,"Windows Firewall",HardeningKitty-Block-TCP-RDP,FirewallRule,Any|Inbound|Block|TCP|3389||,,,,,,,,,False, +277,"Windows Firewall",HardeningKitty-Block-TCP-RPC,FirewallRule,"Any|Inbound|Block|TCP|135,593||",,,,,,,,,False, +278,"Windows Firewall",HardeningKitty-Block-TCP-SMB,FirewallRule,Any|Inbound|Block|TCP|445||,,,,,,,,,False, +279,"Windows Firewall",HardeningKitty-Block-TCP-WinRM,FirewallRule,"Any|Inbound|Block|TCP|5985,5986||",,,,,,,,,False, +280,"Windows Firewall",HardeningKitty-Block-UDP-NetBIOS,FirewallRule,"Any|Inbound|Block|UDP|137,138,139||",,,,,,,,,False, +281,"Windows Firewall",HardeningKitty-Block-UDP-RPC,FirewallRule,"Any|Inbound|Block|UDP|135,593||",,,,,,,,,False, +282,"Windows Firewall",HardeningKitty-Block-calc-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\calc.exe|,,,,,,,,,False, +283,"Windows Firewall",HardeningKitty-Block-calc-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\calc.exe|,,,,,,,,,False, +284,"Windows Firewall",HardeningKitty-Block-certutil-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\certutil.exe|,,,,,,,,,False, +285,"Windows Firewall",HardeningKitty-Block-certutil-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\certutil.exe|,,,,,,,,,False, +286,"Windows Firewall",HardeningKitty-Block-conhost-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\conhost.exe|,,,,,,,,,False, +287,"Windows Firewall",HardeningKitty-Block-conhost-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\conhost.exe|,,,,,,,,,False, +288,"Windows Firewall",HardeningKitty-Block-cscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\cscript.exe|,,,,,,,,,False, +289,"Windows Firewall",HardeningKitty-Block-cscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\cscript.exe|,,,,,,,,,False, +290,"Windows Firewall",HardeningKitty-Block-mshta-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\mshta.exe|,,,,,,,,,False, +291,"Windows Firewall",HardeningKitty-Block-mshta-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\mshta.exe|,,,,,,,,,False, +292,"Windows Firewall",HardeningKitty-Block-notepad-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\notepad.exe|,,,,,,,,,False, +293,"Windows Firewall",HardeningKitty-Block-notepad-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\notepad.exe|,,,,,,,,,False, +296,"Windows Firewall",HardeningKitty-Block-wscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\wscript.exe|,,,,,,,,,False, +297,"Windows Firewall",HardeningKitty-Block-wscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\wscript.exe|,,,,,,,,,False, +39,"Windows Firewall","Inbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultInboundAction,,,,,,,1, +38,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1, +51,"Windows Firewall","Inbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultInboundAction,,,,,,,1, +50,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1, +63,"Windows Firewall","Inbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultInboundAction,,,,,,,1, +62,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1, +45,"Windows Firewall","Log dropped packets (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogDroppedPackets,,,,,,,0, +44,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0, +57,"Windows Firewall","Log dropped packets (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogDroppedPackets,,,,,,,0, +56,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0, +69,"Windows Firewall","Log dropped packets (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogDroppedPackets,,,,,,,0, +68,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0, +43,"Windows Firewall","Log size limit (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogFileSize,,,,,,,4096, +42,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096, +55,"Windows Firewall","Log size limit (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogFileSize,,,,,,,4096, +54,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096, +67,"Windows Firewall","Log size limit (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogFileSize,,,,,,,4096, +66,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096, +47,"Windows Firewall","Log successful connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogSuccessfulConnections,,,,,,,0, +46,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0, +59,"Windows Firewall","Log successful connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogSuccessfulConnections,,,,,,,0, +58,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0, +71,"Windows Firewall","Log successful connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogSuccessfulConnections,,,,,,,0, +70,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0, +517,"Windows Firewall","Name of log file (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogFilePath,,,,"", +519,"Windows Firewall","Name of log file (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogFilePath,,,,"", +523,"Windows Firewall","Name of log file (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFilePath,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogFilePath,,,,"", +41,"Windows Firewall","Outbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultOutboundAction,,,,,,,0, +40,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0, +53,"Windows Firewall","Outbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultOutboundAction,,,,,,,0, +52,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0, +65,"Windows Firewall","Outbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultOutboundAction,,,,,,,0, +64,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0, +337,"Windows Settings","Devices: AutoPlay: Use AutoPlay for all media and devices",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers,DisableAutoplay,,,,,,,0, +336,"Windows Settings","Devices: Typing: Autocorrect misspelled words",Registry,,HKCU:\Software\Microsoft\TabletTip\1.7,EnableAutocorrection,,,,,,,1, +333,"Windows Settings","System: Notification & actions: Get tips, tricks, and suggestions as you use Windows",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-338389Enabled,,,,,,,1, +332,"Windows Settings","System: Notification & actions: Show me the Windows welcome experience after updates and occasionally when I sign in to highlight what's new and suggested",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-310093Enabled,,,,,,,1, +334,"Windows Settings","System: Shared experiences: Shared across devices 1",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,RomeSdkChannelUserAuthzPolicy,,,,,,,1, +335,"Windows Settings","System: Shared experiences: Shared across devices 2",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,CdpSessionUserAuthzPolicy,,,,,,,1, diff --git a/vendor/lists/finding_list_microsoft_windows_tls.csv b/vendor/lists/finding_list_microsoft_windows_tls.csv new file mode 100644 index 0000000..a830592 --- /dev/null +++ b/vendor/lists/finding_list_microsoft_windows_tls.csv @@ -0,0 +1,62 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1000,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Enabled,,,,,,,,,0,,=,,High, +1001,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1002,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Enabled,,,,,,,,,0,,=,,High, +1003,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1004,"Schannel: TLS Settings: Protocols","Server: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Enabled,,,,,,,,,0,,=,,High, +1005,"Schannel: TLS Settings: Protocols","Server: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1006,"Schannel: TLS Settings: Protocols","Client: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Enabled,,,,,,,,,0,,=,,High, +1007,"Schannel: TLS Settings: Protocols","Client: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1008,"Schannel: TLS Settings: Protocols","Server: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Enabled,,,,,,,,,0,,=,,High, +1009,"Schannel: TLS Settings: Protocols","Server: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1010,"Schannel: TLS Settings: Protocols","Client: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Enabled,,,,,,,,,0,,=,,High, +1011,"Schannel: TLS Settings: Protocols","Client: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1012,"Schannel: TLS Settings: Protocols","Server: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Enabled,,,,,,,,,0,,=,,High, +1013,"Schannel: TLS Settings: Protocols","Server: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1014,"Schannel: TLS Settings: Protocols","Client: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Enabled,,,,,,,,,0,,=,,High, +1015,"Schannel: TLS Settings: Protocols","Client: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1016,"Schannel: TLS Settings: Protocols","Server: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Enabled,,,,,,,,,0,,=,,Medium, +1017,"Schannel: TLS Settings: Protocols","Server: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1018,"Schannel: TLS Settings: Protocols","Client: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Enabled,,,,,,,,,0,,=,,Medium, +1019,"Schannel: TLS Settings: Protocols","Client: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1020,"Schannel: TLS Settings: Protocols","Server: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Enabled,,,,,,,,,0,,=,,Medium, +1021,"Schannel: TLS Settings: Protocols","Server: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1022,"Schannel: TLS Settings: Protocols","Client: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Enabled,,,,,,,,,0,,=,,Medium, +1023,"Schannel: TLS Settings: Protocols","Client: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1024,"Schannel: TLS Settings: Protocols","Server: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Enabled,,,,,,,,,1,,=,,Medium, +1025,"Schannel: TLS Settings: Protocols","Server: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1026,"Schannel: TLS Settings: Protocols","Client: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Enabled,,,,,,,,,1,,=,,Medium, +1027,"Schannel: TLS Settings: Protocols","Client: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1028,"Schannel: TLS Settings: Ciphers",NULL,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL,Enabled,,,,,,,,,0,,=,,High, +1029,"Schannel: TLS Settings: Ciphers","DES 56/56",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56",Enabled,,,,,,,,,0,,=,,High, +1030,"Schannel: TLS Settings: Ciphers","RC2 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128",Enabled,,,,,,,,,0,,=,,High, +1031,"Schannel: TLS Settings: Ciphers","RC2 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128",Enabled,,,,,,,,,0,,=,,High, +1032,"Schannel: TLS Settings: Ciphers","RC2 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128",Enabled,,,,,,,,,0,,=,,High, +1033,"Schannel: TLS Settings: Ciphers","RC4 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128",Enabled,,,,,,,,,0,,=,,High, +1034,"Schannel: TLS Settings: Ciphers","RC4 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128",Enabled,,,,,,,,,0,,=,,High, +1035,"Schannel: TLS Settings: Ciphers","RC4 64/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128",Enabled,,,,,,,,,0,,=,,High, +1036,"Schannel: TLS Settings: Ciphers","RC4 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128",Enabled,,,,,,,,,0,,=,,High, +1037,"Schannel: TLS Settings: Ciphers","Triple DES 168",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168",Enabled,,,,,,,,,0,,=,,Medium, +1038,"Schannel: TLS Settings: Ciphers","AES 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128",Enabled,,,,,,,,,1,,=,,Medium, +1039,"Schannel: TLS Settings: Ciphers","AES 256/256",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256",Enabled,,,,,,,,,1,,=,,Medium, +1040,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,,,"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",,=,,Medium, +1065,"Administrative Templates: Network","SSL Configuration Settings: ECC Curve Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,EccCurves,,,,,,,,,NistP384;NistP256,,=,,Medium, +1041,"Schannel: TLS Settings: Hashes",MD5,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5,Enabled,,,,,,,,,0,,=,,Medium, +1042,"Schannel: TLS Settings: Hashes",SHA-1,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA,Enabled,,,,,,,,,0,,=,,Medium, +1043,"Schannel: TLS Settings: Hashes",SHA-256,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256,Enabled,,,,,,,,,4294967295,,=,,Medium, +1044,"Schannel: TLS Settings: Hashes",SHA-384,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384,Enabled,,,,,,,,,4294967295,,=,,Medium, +1045,"Schannel: TLS Settings: Hashes",SHA-512,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512,Enabled,,,,,,,,,4294967295,,=,,Medium, +1046,"Schannel: TLS Settings: KeyExchangeAlgorithms",Diffie-Hellman,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,Enabled,,,,,,,,,4294967295,,=,,Medium, +1047,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ServerMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ServerMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1048,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ClientMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1049,"Schannel: TLS Settings: KeyExchangeAlgorithms",ECDH,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH,Enabled,,,,,,,,,4294967295,,=,,Medium, +1050,"Schannel: TLS Settings: KeyExchangeAlgorithms",PKCS,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,Enabled,,,,,,,,,4294967295,,=,,Medium, +1051,"Schannel: TLS Settings: KeyExchangeAlgorithms","PKCS (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,ClientMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1052,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1053,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1054,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1055,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1056,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1057,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1058,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1059,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_microsoft_windows_tls_future.csv b/vendor/lists/finding_list_microsoft_windows_tls_future.csv new file mode 100644 index 0000000..a21a290 --- /dev/null +++ b/vendor/lists/finding_list_microsoft_windows_tls_future.csv @@ -0,0 +1,66 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1000,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Enabled,,,,,,,,,0,,=,,High, +1001,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1002,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Enabled,,,,,,,,,0,,=,,High, +1003,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1004,"Schannel: TLS Settings: Protocols","Server: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Enabled,,,,,,,,,0,,=,,High, +1005,"Schannel: TLS Settings: Protocols","Server: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1006,"Schannel: TLS Settings: Protocols","Client: PCT",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Enabled,,,,,,,,,0,,=,,High, +1007,"Schannel: TLS Settings: Protocols","Client: PCT (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1008,"Schannel: TLS Settings: Protocols","Server: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Enabled,,,,,,,,,0,,=,,High, +1009,"Schannel: TLS Settings: Protocols","Server: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1010,"Schannel: TLS Settings: Protocols","Client: SSLv2.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Enabled,,,,,,,,,0,,=,,High, +1011,"Schannel: TLS Settings: Protocols","Client: SSLv2.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1012,"Schannel: TLS Settings: Protocols","Server: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Enabled,,,,,,,,,0,,=,,High, +1013,"Schannel: TLS Settings: Protocols","Server: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server",Disabledbydefault,,,,,,,,,1,,=,,High, +1014,"Schannel: TLS Settings: Protocols","Client: SSLv3.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Enabled,,,,,,,,,0,,=,,High, +1015,"Schannel: TLS Settings: Protocols","Client: SSLv3.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client",Disabledbydefault,,,,,,,,,1,,=,,High, +1016,"Schannel: TLS Settings: Protocols","Server: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Enabled,,,,,,,,,0,,=,,Medium, +1017,"Schannel: TLS Settings: Protocols","Server: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1018,"Schannel: TLS Settings: Protocols","Client: TLSv1.0",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Enabled,,,,,,,,,0,,=,,Medium, +1019,"Schannel: TLS Settings: Protocols","Client: TLSv1.0 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1020,"Schannel: TLS Settings: Protocols","Server: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Enabled,,,,,,,,,0,,=,,Medium, +1021,"Schannel: TLS Settings: Protocols","Server: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1022,"Schannel: TLS Settings: Protocols","Client: TLSv1.1",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Enabled,,,,,,,,,0,,=,,Medium, +1023,"Schannel: TLS Settings: Protocols","Client: TLSv1.1 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client",Disabledbydefault,,,,,,,,,1,,=,,Medium, +1024,"Schannel: TLS Settings: Protocols","Server: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Enabled,,,,,,,,,1,,=,,Medium, +1025,"Schannel: TLS Settings: Protocols","Server: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1026,"Schannel: TLS Settings: Protocols","Client: TLSv1.2",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Enabled,,,,,,,,,1,,=,,Medium, +1027,"Schannel: TLS Settings: Protocols","Client: TLSv1.2 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1060,"Schannel: TLS Settings: Protocols","Server: TLSv1.3",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server",Enabled,,,,,,,,,1,,=,,Medium, +1061,"Schannel: TLS Settings: Protocols","Server: TLSv1.3 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1062,"Schannel: TLS Settings: Protocols","Client: TLSv1.3",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client",Enabled,,,,,,,,,1,,=,,Medium, +1063,"Schannel: TLS Settings: Protocols","Client: TLSv1.3 (Disabledbydefault)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client",Disabledbydefault,,,,,,,,,0,,=,,Medium, +1028,"Schannel: TLS Settings: Ciphers",NULL,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL,Enabled,,,,,,,,,0,,=,,High, +1029,"Schannel: TLS Settings: Ciphers","DES 56/56",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56",Enabled,,,,,,,,,0,,=,,High, +1030,"Schannel: TLS Settings: Ciphers","RC2 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128",Enabled,,,,,,,,,0,,=,,High, +1031,"Schannel: TLS Settings: Ciphers","RC2 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128",Enabled,,,,,,,,,0,,=,,High, +1032,"Schannel: TLS Settings: Ciphers","RC2 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128",Enabled,,,,,,,,,0,,=,,High, +1033,"Schannel: TLS Settings: Ciphers","RC4 40/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128",Enabled,,,,,,,,,0,,=,,High, +1034,"Schannel: TLS Settings: Ciphers","RC4 56/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128",Enabled,,,,,,,,,0,,=,,High, +1035,"Schannel: TLS Settings: Ciphers","RC4 64/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128",Enabled,,,,,,,,,0,,=,,High, +1036,"Schannel: TLS Settings: Ciphers","RC4 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128",Enabled,,,,,,,,,0,,=,,High, +1037,"Schannel: TLS Settings: Ciphers","Triple DES 168",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168",Enabled,,,,,,,,,0,,=,,Medium, +1038,"Schannel: TLS Settings: Ciphers","AES 128/128",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128",Enabled,,,,,,,,,1,,=,,Medium, +1039,"Schannel: TLS Settings: Ciphers","AES 256/256",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256",Enabled,,,,,,,,,1,,=,,Medium, +1064,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,Functions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CipherSuiteOrder,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CipherSuiteOrder,SSLCipherSuiteOrder,,,,,,"TLS_CHACHA20_POLY1305_SHA256,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",,=,,Medium, +1065,"Administrative Templates: Network","SSL Configuration Settings: ECC Curve Order",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002,EccCurves,,,,,,,,,Curve25519;NistP384;NistP256,,=,,Medium, +1041,"Schannel: TLS Settings: Hashes",MD5,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5,Enabled,,,,,,,,,0,,=,,Medium, +1042,"Schannel: TLS Settings: Hashes",SHA-1,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA,Enabled,,,,,,,,,0,,=,,Medium, +1043,"Schannel: TLS Settings: Hashes",SHA-256,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256,Enabled,,,,,,,,,4294967295,,=,,Medium, +1044,"Schannel: TLS Settings: Hashes",SHA-384,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384,Enabled,,,,,,,,,4294967295,,=,,Medium, +1045,"Schannel: TLS Settings: Hashes",SHA-512,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512,Enabled,,,,,,,,,4294967295,,=,,Medium, +1046,"Schannel: TLS Settings: KeyExchangeAlgorithms",Diffie-Hellman,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,Enabled,,,,,,,,,4294967295,,=,,Medium, +1047,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ServerMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ServerMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1048,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman,ClientMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1049,"Schannel: TLS Settings: KeyExchangeAlgorithms",ECDH,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH,Enabled,,,,,,,,,4294967295,,=,,Medium, +1050,"Schannel: TLS Settings: KeyExchangeAlgorithms",PKCS,Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,Enabled,,,,,,,,,0,,=,,Medium, +1051,"Schannel: TLS Settings: KeyExchangeAlgorithms","PKCS (ClientMinKeyBitLength)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS,ClientMinKeyBitLength,,,,,,,,,2048,,>=,,Medium, +1052,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1053,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1054,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1055,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1056,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1057,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319, 32bit)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, +1058,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SystemDefaultTlsVersions,,,,,,,,,1,,=,,Medium, +1059,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319)",Registry,,HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319,SchUseStrongCrypto,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_107_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_107_machine.csv new file mode 100644 index 0000000..a47b989 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_107_machine.csv @@ -0,0 +1,24 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1024,"Administrative Templates: Windows Components","Microsoft Edge: Allow using the deprecated U2F Security Key API (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,U2fSecurityKeyApiEnabled,,,,,,,,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1025,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,WebSQLAccess,,,,,,,,,0,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1020,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,,,1,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_112_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_112_machine.csv new file mode 100644 index 0000000..551212e --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_112_machine.csv @@ -0,0 +1,21 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1025,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,WebSQLAccess,,,,,,,,,0,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_114_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_114_machine.csv new file mode 100644 index 0000000..ff58446 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_114_machine.csv @@ -0,0 +1,19 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1025,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,WebSQLAccess,,,,,,,,,0,,=,,Low, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_117_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_117_machine.csv new file mode 100644 index 0000000..6dc5b16 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_117_machine.csv @@ -0,0 +1,20 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1026,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev117~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev117~Policy~microsoft_edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1025,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,WebSQLAccess,,,,,,,,,0,,=,,Low, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_128_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_128_machine.csv new file mode 100644 index 0000000..9015f16 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_128_machine.csv @@ -0,0 +1,20 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,=,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,=,Low, +1026,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev117~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev117~Policy~microsoft_edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,,,,,,0,,=,=,Low, +1027,"Administrative Templates: Windows Components","Microsoft Edge: Dynamic Code Settings",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DynamicCodeSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128~Policy~microsoft_edge,DynamicCodeSettings,,,,,,1,,=,contains,Low, +1028,"Administrative Templates: Windows Components","Microsoft Edge: Enable Application Bound Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ApplicationBoundEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128.1~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128.1~Policy~microsoft_edge,ApplicationBoundEncryptionEnabled,,,,,,1,,=,=,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,=,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,=,Low, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,=,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,=,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,=,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,contains,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,=,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate","",=,=,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,=,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,=,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,=,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,=,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,=,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,=,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_139_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_139_machine.csv new file mode 100644 index 0000000..090196d --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_139_machine.csv @@ -0,0 +1,20 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1029,"Administrative Templates: Windows Components","Microsoft Edge: Allow software WebGL fallback using SwiftShader",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableUnsafeSwiftShader,,,,,,,,,0,,=,=,Low, +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,=,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,=,Low, +1026,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev117~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev117~Policy~microsoft_edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,,,,,,0,,=,=,Low, +1027,"Administrative Templates: Windows Components","Microsoft Edge: Dynamic Code Settings",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DynamicCodeSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128~Policy~microsoft_edge,DynamicCodeSettings,,,,,,1,,=,contains,Low, +1028,"Administrative Templates: Windows Components","Microsoft Edge: Enable Application Bound Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ApplicationBoundEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128.1~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128.1~Policy~microsoft_edge,ApplicationBoundEncryptionEnabled,,,,,,1,,=,=,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,=,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,=,Low, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,=,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,=,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,=,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,contains,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,=,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate","",=,=,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,=,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,=,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,=,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,=,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,=,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_151_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_151_machine.csv new file mode 100644 index 0000000..9a35ada --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_151_machine.csv @@ -0,0 +1,25 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1029,"Administrative Templates: Windows Components","Microsoft Edge: Allow software WebGL fallback using SwiftShader",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableUnsafeSwiftShader,,,,,,,,,0,,=,=,Low, +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,=,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,=,Low, +1026,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev117~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev117~Policy~microsoft_edge,InternetExplorerIntegrationZoneIdentifierMhtFileAllowed,,,,,,0,,=,=,Low, +1030,"Administrative Templates: Windows Components","Microsoft Edge: Configure browser process code integrity guard setting",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserCodeIntegritySetting,,,,,,,,,2,,=,,Low, +1027,"Administrative Templates: Windows Components","Microsoft Edge: Dynamic Code Settings",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DynamicCodeSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128~Policy~microsoft_edge,DynamicCodeSettings,,,,,,1,,=,contains,Low, +1028,"Administrative Templates: Windows Components","Microsoft Edge: Enable Application Bound Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ApplicationBoundEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev128.1~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev128.1~Policy~microsoft_edge,ApplicationBoundEncryptionEnabled,,,,,,1,,=,=,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,=,Low, +1031,"Administrative Templates: Windows Components","Microsoft Edge: Enable Process Isolation",Registry,,HKLM:\Software\Policies\Microsoft\Edge,ProcessIsolationEnabled,,,,,,,,,1,,=,,Low, +1032,"Administrative Templates: Windows Components","Microsoft Edge: Enable renderer in app container",Registry,,HKLM:\Software\Policies\Microsoft\Edge,RendererAppContainerEnabled,,,,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,=,Low, +1033,"Administrative Templates: Windows Components","Microsoft Edge: Enable the network service sandbox",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NetworkServiceSandboxEnabled,,,,,,,,,1,,=,,Low, +1034,"Administrative Templates: Windows Components","Microsoft Edge: Enhance the security state in Microsoft Edge",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnhanceSecurityMode,,,,,,,,,1,,=,,Low, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,=,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,=,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,=,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,contains,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,=,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate","",=,=,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,=,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,=,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,=,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,=,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,=,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_87_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_87_machine.csv new file mode 100644 index 0000000..77f8a22 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_87_machine.csv @@ -0,0 +1,14 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1003,"Administrative Templates: Windows Components","Microsoft Edge: Default Adobe Flash setting (obsolete)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DefaultPluginsSetting,,,,,,,0,,2,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableSha1ForLocalAnchors,,,,,,,0,,0,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_88_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_88_machine.csv new file mode 100644 index 0000000..44b6667 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_88_machine.csv @@ -0,0 +1,15 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1003,"Administrative Templates: Windows Components","Microsoft Edge: Default Adobe Flash setting (obsolete)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DefaultPluginsSetting,,,,,,,0,,2,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EnableSha1ForLocalAnchors,,,,,,,0,,0,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_92_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_92_machine.csv new file mode 100644 index 0000000..1fcbb10 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_92_machine.csv @@ -0,0 +1,17 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1003,"Administrative Templates: Windows Components","Microsoft Edge: Default Adobe Flash setting (obsolete)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DefaultPluginsSetting,,,,,,,0,,2,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_93_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_93_machine.csv new file mode 100644 index 0000000..841f7cd --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_93_machine.csv @@ -0,0 +1,17 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_95_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_95_machine.csv new file mode 100644 index 0000000..32196e6 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_95_machine.csv @@ -0,0 +1,19 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1020,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,,,1,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_96_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_96_machine.csv new file mode 100644 index 0000000..2f3ffb0 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_96_machine.csv @@ -0,0 +1,21 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1020,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,,,1,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_97_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_97_machine.csv new file mode 100644 index 0000000..34359c4 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_97_machine.csv @@ -0,0 +1,22 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1020,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,,,1,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_edge_98_machine.csv b/vendor/lists/finding_list_msft_security_baseline_edge_98_machine.csv new file mode 100644 index 0000000..8358940 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_edge_98_machine.csv @@ -0,0 +1,23 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +1015,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerIntegrationReloadInIEModeAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge,InternetExplorerIntegrationReloadInIEModeAllowed,,,,,,0,,=,,Low, +1000,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLErrorOverrideAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SSLErrorOverrideAllowed,,,,1,,0,,=,,Low, +1024,"Administrative Templates: Windows Components","Microsoft Edge: Allow using the deprecated U2F Security Key API (deprecated)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,U2fSecurityKeyApiEnabled,,,,,,,,,0,,=,,Low, +1018,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TripleDESEnabled,,,,,,,,,0,,=,,Low, +1019,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BrowserLegacyExtensionPointsBlockingEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev95~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev95~Policy~microsoft_edge,BrowserLegacyExtensionPointsBlockingEnabled,,,,,,1,,=,,Low, +1001,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SitePerProcess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge,SitePerProcess,,,,0,,1,,=,,Low, +1023,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,EdgeEnhanceImagesEnabled,,,,,,,,,0,,=,,Low, +1002,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SSLVersionMin,,,,,,,0,,tls1.2,,=,,Medium, +1021,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InternetExplorerModeToolbarButtonEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge,InternetExplorerModeToolbarButtonEnabled,,,,,,0,,=,,Low, +1017,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SharedArrayBufferUnrestrictedAccessAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev111~Policy~microsoft_edge,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev111~Policy~microsoft_edge,SharedArrayBufferUnrestrictedAccessAllowed,,,,,,0,,=,,Low, +1020,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",Registry,,HKLM:\Software\Policies\Microsoft\Edge,DisplayCapturePermissionsPolicyEnabled,,,,,,,,,1,,=,,Low, +1004,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",Registry,,HKLM:\Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist,1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~Extensions,ExtensionInstallBlocklist,,,,0,,*,,=,,Low, +1012,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",Registry,,HKLM:\Software\Policies\Microsoft\Edge,BasicAuthOverHttpEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev88.0.705.23~Policy~microsoft_edge~HTTPAuthentication,BasicAuthOverHttpEnabled,,,,,,0,,=,,Low, +1005,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",Registry,,HKLM:\Software\Policies\Microsoft\Edge,AuthSchemes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~HTTPAuthentication,AuthSchemes,,,,0,,"ntlm,negotiate",,=,,Low, +1006,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",Registry,,HKLM:\Software\Policies\Microsoft\Edge,NativeMessagingUserLevelHosts,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~NativeMessaging,NativeMessagingUserLevelHosts,,,,1,,0,,=,,Low, +1007,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PasswordManagerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,1,,0,,=,,Low, +1016,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",Registry,,HKLM:\Software\Policies\Microsoft\Edge,InsecurePrivateNetworkRequestsAllowed,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev92~Policy~microsoft_edge~PrivateNetworkRequestSettings,InsecurePrivateNetworkRequestsAllowed,,,,,,0,,=,,Low, +1008,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,SmartScreenEnabled,,,,0,,1,,=,,Low, +1009,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",Registry,,HKLM:\Software\Policies\Microsoft\Edge,SmartScreenPuaEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev80diff~Policy~microsoft_edge~SmartScreen,SmartScreenPuaEnabled,,,,0,,1,,=,,Low, +1010,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverride,,,,,,1,,=,,Low, +1011,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",Registry,,HKLM:\Software\Policies\Microsoft\Edge,PreventSmartScreenPromptOverrideForFiles,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edge~Policy~microsoft_edge~SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edge~Policy~microsoft_edge~SmartScreen,PreventSmartScreenPromptOverrideForFiles,,,,0,,1,,=,,Low, +1022,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",Registry,,HKLM:\Software\Policies\Microsoft\Edge,TyposquattingCheckerEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\microsoft_edgev96~Policy~microsoft_edge~TyposquattingChecker,TyposquattingCheckerEnabled,,,,,,1,,=,,Low, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv new file mode 100644 index 0000000..39a1ece --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv new file mode 100644 index 0000000..2fadf83 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv @@ -0,0 +1,152 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5095,"Office 2016 / Office 365","Microsoft Outlook: Junk E-mail protection level",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailprotection,,,,,,,,,3,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv new file mode 100644 index 0000000..0d2957f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv new file mode 100644 index 0000000..f1b508f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv @@ -0,0 +1,153 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5231,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,,,1,,=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5095,"Office 2016 / Office 365","Microsoft Outlook: Junk E-mail protection level",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailprotection,,,,,,,,,3,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv new file mode 100644 index 0000000..0d2957f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv new file mode 100644 index 0000000..a127e7a --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv @@ -0,0 +1,152 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5231,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,,,1,,=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv new file mode 100644 index 0000000..0d2957f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv new file mode 100644 index 0000000..d964bf3 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv @@ -0,0 +1,156 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5232,"Office 2016 / Office 365","Microsoft Excel: Block Excel XLL Add-ins that come from an untrusted source",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,blockxllfrominternet,,,,,,,,,1,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5231,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,,,1,,=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5235,"Office 2016 / Office 365","Security Settings: Allow Basic Authentication prompts from network proxies",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\identity,basicauthproxybehavior,,,,,,,,,0,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5233,"Office 2016 / Office 365","Security Settings: Encryption mode for Information Rights Management (IRM)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\drm,compatibleencryption,,,,,,,,,1,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5234,"Office 2016 / Office 365","Microsoft Publisher: Block macros from running in Office files from the internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv new file mode 100644 index 0000000..0d2957f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv new file mode 100644 index 0000000..0718572 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv @@ -0,0 +1,170 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5236,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5237,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5232,"Office 2016 / Office 365","Microsoft Excel: Block Excel XLL Add-ins that come from an untrusted source",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,blockxllfrominternet,,,,,,,,,1,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5240,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Enable Excel 4.0 macros when VBA macros are enabled",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrowarningfollowvba,,,,,,,,,0,,=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5238,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5239,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5231,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,,,1,,=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5235,"Office 2016 / Office 365","Security Settings: Allow Basic Authentication prompts from network proxies",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\identity,basicauthproxybehavior,,,,,,,,,0,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5233,"Office 2016 / Office 365","Security Settings: Encryption mode for Information Rights Management (IRM)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\drm,compatibleencryption,,,,,,,,,1,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5241,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5242,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5243,"Office 2016 / Office 365","Microsoft Project: Block macros from running in Office files from the internet",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5234,"Office 2016 / Office 365","Microsoft Publisher: Block macros from running in Office files from the internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5244,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5245,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5246,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5247,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5248,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5249,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv new file mode 100644 index 0000000..0d2957f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv @@ -0,0 +1,195 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6185,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",excel.exe,,,,,,,,,69632,,=,,Medium, +6186,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",mspub.exe,,,,,,,,,69632,,=,,Medium, +6187,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",powerpnt.exe,,,,,,,,,69632,,=,,Medium, +6188,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",onenote.exe,,,,,,,,,69632,,=,,Medium, +6189,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",visio.exe,,,,,,,,,69632,,=,,Medium, +6190,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winproj.exe,,,,,,,,,69632,,=,,Medium, +6191,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",winword.exe,,,,,,,,,69632,,=,,Medium, +6192,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",outlook.exe,,,,,,,,,69632,,=,,Medium, +6193,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",Registry,,"HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE",msaccess.exe,,,,,,,,,69632,,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv new file mode 100644 index 0000000..f235319 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv @@ -0,0 +1,176 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5227,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5236,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5237,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5232,"Office 2016 / Office 365","Microsoft Excel: Block Excel XLL Add-ins that come from an untrusted source",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,blockxllfrominternet,,,,,,,,,1,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5240,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Enable Excel 4.0 macros when VBA macros are enabled",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrowarningfollowvba,,,,,,,,,0,,=,,Medium, +5224,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5238,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5239,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5231,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,xl4macrooff,,,,,,,,,1,,=,,Medium, +5222,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5250,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: File Block includes external link files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,fileblockexternallinks,,,,,,,,,1,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5235,"Office 2016 / Office 365","Security Settings: Allow Basic Authentication prompts from network proxies",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\identity,basicauthproxybehavior,,,,,,,,,0,,=,,Medium, +5210,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",Registry,,HKCU:\software\policies\microsoft\vba\security,allowvbaintranetreferences,,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5251,"Office 2016 / Office 365","Security Settings: Block Insecure Protocols",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\fileio,blockinsecureprotocols,,,,,,,,,1,,=,,Medium, +5252,"Office 2016 / Office 365","Security Settings: Block OLE Graph",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,blockolegraph,,,,,,,,,1,,=,,Medium, +5253,"Office 2016 / Office 365","Security Settings: Block OrgChart",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,blockorgchart,,,,,,,,,1,,=,,Medium, +5211,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbabehavior,,,,,,,,,1,,=,,Medium, +5212,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common,fbaenabledhosts,,,,,,,,," ",,=,,Medium, +5213,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",Registry,,HKCU:\software\policies\microsoft\vba\security,disablestrictvbarefssecurity,,,,,,,,,0,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5233,"Office 2016 / Office 365","Security Settings: Encryption mode for Information Rights Management (IRM)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\drm,compatibleencryption,,,,,,,,,1,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5214,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,,,2,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, +5254,"Office 2016 / Office 365","Security Settings: Restrict Apps from FPRPC Fallback",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\fileio,blockwecfallback,,,,,,,,,1,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5255,"Office 2016 / Office 365","Microsoft PowerPoint: OLE Active Content",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,enableoleactions,,,,,,,,,,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5223,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5225,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5241,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5242,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5243,"Office 2016 / Office 365","Microsoft Project: Block macros from running in Office files from the internet",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5217,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",requireaddinsig,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5234,"Office 2016 / Office 365","Microsoft Publisher: Block macros from running in Office files from the internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5218,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5229,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5244,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5245,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5219,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5230,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5246,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5247,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5220,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,allowdde,,,,,,,0,,0,,=,,Medium, +5221,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,requireaddinsig,,,,,,,,,1,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5226,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbadigsigtrustedpublishers,,,,,,,,,1,,=,,Medium, +5248,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequirelmtrustedpublisher,,,,,,,,,0,,=,,Medium, +5249,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbarequiredigsigwithcodesigningeku,,,,,,,,,0,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv b/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv new file mode 100644 index 0000000..04b65e2 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv @@ -0,0 +1,186 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +6000,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",excel.exe,,,,,,,,,1,,=,,Medium, +6001,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",exprwd.exe,,,,,,,,,1,,=,,Medium, +6002,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",groove.exe,,,,,,,,,1,,=,,Medium, +6003,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",msaccess.exe,,,,,,,,,1,,=,,Medium, +6004,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mse7.exe,,,,,,,,,1,,=,,Medium, +6005,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",mspub.exe,,,,,,,,,1,,=,,Medium, +6006,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",onenote.exe,,,,,,,,,1,,=,,Medium, +6007,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",outlook.exe,,,,,,,,,1,,=,,Medium, +6008,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6009,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",pptview.exe,,,,,,,,,1,,=,,Medium, +6010,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",spdesign.exe,,,,,,,,,1,,=,,Medium, +6011,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",visio.exe,,,,,,,,,1,,=,,Medium, +6012,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winproj.exe,,,,,,,,,1,,=,,Medium, +6013,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management",winword.exe,,,,,,,,,1,,=,,Medium, +6014,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",excel.exe,,,,,,,,,1,,=,,Medium, +6015,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",exprwd.exe,,,,,,,,,1,,=,,Medium, +6016,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",groove.exe,,,,,,,,,1,,=,,Medium, +6017,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",msaccess.exe,,,,,,,,,1,,=,,Medium, +6018,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mse7.exe,,,,,,,,,1,,=,,Medium, +6019,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",mspub.exe,,,,,,,,,1,,=,,Medium, +6020,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",onenote.exe,,,,,,,,,1,,=,,Medium, +6021,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",outlook.exe,,,,,,,,,1,,=,,Medium, +6022,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6023,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",pptview.exe,,,,,,,,,1,,=,,Medium, +6024,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",spdesign.exe,,,,,,,,,1,,=,,Medium, +6025,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",visio.exe,,,,,,,,,1,,=,,Medium, +6026,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winproj.exe,,,,,,,,,1,,=,,Medium, +6027,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling",winword.exe,,,,,,,,,1,,=,,Medium, +6028,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",excel.exe,,,,,,,,,1,,=,,Medium, +6029,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",exprwd.exe,,,,,,,,,1,,=,,Medium, +6030,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",groove.exe,,,,,,,,,1,,=,,Medium, +6031,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",msaccess.exe,,,,,,,,,1,,=,,Medium, +6032,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mse7.exe,,,,,,,,,1,,=,,Medium, +6033,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",mspub.exe,,,,,,,,,1,,=,,Medium, +6034,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",onenote.exe,,,,,,,,,1,,=,,Medium, +6035,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",outlook.exe,,,,,,,,,1,,=,,Medium, +6036,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6037,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",pptview.exe,,,,,,,,,1,,=,,Medium, +6038,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",spdesign.exe,,,,,,,,,1,,=,,Medium, +6039,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",visio.exe,,,,,,,,,1,,=,,Medium, +6040,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winproj.exe,,,,,,,,,1,,=,,Medium, +6041,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable",winword.exe,,,,,,,,,1,,=,,Medium, +6042,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",excel.exe,,,,,,,,,1,,=,,Medium, +6043,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",exprwd.exe,,,,,,,,,1,,=,,Medium, +6044,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",groove.exe,,,,,,,,,1,,=,,Medium, +6045,"Office 2016 / Office 365","IE Security: Information Bar (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",msaccess.exe,,,,,,,,,1,,=,,Medium, +6046,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mse7.exe,,,,,,,,,1,,=,,Medium, +6047,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",mspub.exe,,,,,,,,,1,,=,,Medium, +6048,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",onenote.exe,,,,,,,,,1,,=,,Medium, +6049,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",outlook.exe,,,,,,,,,1,,=,,Medium, +6050,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6051,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",pptview.exe,,,,,,,,,1,,=,,Medium, +6052,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",spdesign.exe,,,,,,,,,1,,=,,Medium, +6053,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",visio.exe,,,,,,,,,1,,=,,Medium, +6054,"Office 2016 / Office 365","IE Security: Information Bar (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winproj.exe,,,,,,,,,1,,=,,Medium, +6055,"Office 2016 / Office 365","IE Security: Information Bar (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_securityband",winword.exe,,,,,,,,,1,,=,,Medium, +6056,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",excel.exe,,,,,,,,,1,,=,,Medium, +6057,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",exprwd.exe,,,,,,,,,1,,=,,Medium, +6058,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",groove.exe,,,,,,,,,1,,=,,Medium, +6059,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",msaccess.exe,,,,,,,,,1,,=,,Medium, +6060,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mse7.exe,,,,,,,,,1,,=,,Medium, +6061,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",mspub.exe,,,,,,,,,1,,=,,Medium, +6062,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",onenote.exe,,,,,,,,,1,,=,,Medium, +6063,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",outlook.exe,,,,,,,,,1,,=,,Medium, +6064,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6065,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",pptview.exe,,,,,,,,,1,,=,,Medium, +6066,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",spdesign.exe,,,,,,,,,1,,=,,Medium, +6067,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",visio.exe,,,,,,,,,1,,=,,Medium, +6068,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winproj.exe,,,,,,,,,1,,=,,Medium, +6069,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown",winword.exe,,,,,,,,,1,,=,,Medium, +6070,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",excel.exe,,,,,,,,,1,,=,,Medium, +6071,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",exprwd.exe,,,,,,,,,1,,=,,Medium, +6072,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",groove.exe,,,,,,,,,1,,=,,Medium, +6073,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",msaccess.exe,,,,,,,,,1,,=,,Medium, +6074,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mse7.exe,,,,,,,,,1,,=,,Medium, +6075,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",mspub.exe,,,,,,,,,1,,=,,Medium, +6076,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",onenote.exe,,,,,,,,,1,,=,,Medium, +6077,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",outlook.exe,,,,,,,,,1,,=,,Medium, +6078,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6079,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",pptview.exe,,,,,,,,,1,,=,,Medium, +6080,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",spdesign.exe,,,,,,,,,1,,=,,Medium, +6081,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",visio.exe,,,,,,,,,1,,=,,Medium, +6082,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winproj.exe,,,,,,,,,1,,=,,Medium, +6083,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing",winword.exe,,,,,,,,,1,,=,,Medium, +6084,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",excel.exe,,,,,,,,,1,,=,,Medium, +6085,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",exprwd.exe,,,,,,,,,1,,=,,Medium, +6086,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",groove.exe,,,,,,,,,1,,=,,Medium, +6087,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",msaccess.exe,,,,,,,,,1,,=,,Medium, +6088,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mse7.exe,,,,,,,,,1,,=,,Medium, +6089,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",mspub.exe,,,,,,,,,1,,=,,Medium, +6090,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",onenote.exe,,,,,,,,,1,,=,,Medium, +6091,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",outlook.exe,,,,,,,,,1,,=,,Medium, +6092,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6093,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",pptview.exe,,,,,,,,,1,,=,,Medium, +6094,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",spdesign.exe,,,,,,,,,1,,=,,Medium, +6095,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",visio.exe,,,,,,,,,1,,=,,Medium, +6096,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winproj.exe,,,,,,,,,1,,=,,Medium, +6097,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url",winword.exe,,,,,,,,,1,,=,,Medium, +6098,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",excel.exe,,,,,,,,,1,,=,,Medium, +6099,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",exprwd.exe,,,,,,,,,1,,=,,Medium, +6100,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",groove.exe,,,,,,,,,1,,=,,Medium, +6101,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",msaccess.exe,,,,,,,,,1,,=,,Medium, +6102,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mse7.exe,,,,,,,,,1,,=,,Medium, +6103,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",mspub.exe,,,,,,,,,1,,=,,Medium, +6104,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",onenote.exe,,,,,,,,,1,,=,,Medium, +6105,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",outlook.exe,,,,,,,,,1,,=,,Medium, +6106,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6107,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",pptview.exe,,,,,,,,,1,,=,,Medium, +6108,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",spdesign.exe,,,,,,,,,1,,=,,Medium, +6109,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",visio.exe,,,,,,,,,1,,=,,Medium, +6110,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winproj.exe,,,,,,,,,1,,=,,Medium, +6111,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching",winword.exe,,,,,,,,,1,,=,,Medium, +6112,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",excel.exe,,,,,,,,,1,,=,,Medium, +6113,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",exprwd.exe,,,,,,,,,1,,=,,Medium, +6114,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",groove.exe,,,,,,,,,1,,=,,Medium, +6115,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",msaccess.exe,,,,,,,,,1,,=,,Medium, +6116,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mse7.exe,,,,,,,,,1,,=,,Medium, +6117,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",mspub.exe,,,,,,,,,1,,=,,Medium, +6118,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",onenote.exe,,,,,,,,,1,,=,,Medium, +6119,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",outlook.exe,,,,,,,,,1,,=,,Medium, +6120,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6121,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",pptview.exe,,,,,,,,,1,,=,,Medium, +6122,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",spdesign.exe,,,,,,,,,1,,=,,Medium, +6123,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",visio.exe,,,,,,,,,1,,=,,Medium, +6124,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winproj.exe,,,,,,,,,1,,=,,Medium, +6125,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation",winword.exe,,,,,,,,,1,,=,,Medium, +6126,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",excel.exe,,,,,,,,,1,,=,,Medium, +6127,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",exprwd.exe,,,,,,,,,1,,=,,Medium, +6128,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",groove.exe,,,,,,,,,1,,=,,Medium, +6129,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",msaccess.exe,,,,,,,,,1,,=,,Medium, +6130,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mse7.exe,,,,,,,,,1,,=,,Medium, +6131,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",mspub.exe,,,,,,,,,1,,=,,Medium, +6132,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",onenote.exe,,,,,,,,,1,,=,,Medium, +6133,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",outlook.exe,,,,,,,,,1,,=,,Medium, +6134,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6135,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",pptview.exe,,,,,,,,,1,,=,,Medium, +6136,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",spdesign.exe,,,,,,,,,1,,=,,Medium, +6137,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",visio.exe,,,,,,,,,1,,=,,Medium, +6138,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winproj.exe,,,,,,,,,1,,=,,Medium, +6139,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall",winword.exe,,,,,,,,,1,,=,,Medium, +6140,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",excel.exe,,,,,,,,,1,,=,,Medium, +6141,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",exprwd.exe,,,,,,,,,1,,=,,Medium, +6142,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",groove.exe,,,,,,,,,1,,=,,Medium, +6143,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",msaccess.exe,,,,,,,,,1,,=,,Medium, +6144,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mse7.exe,,,,,,,,,1,,=,,Medium, +6145,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",mspub.exe,,,,,,,,,1,,=,,Medium, +6146,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",onenote.exe,,,,,,,,,1,,=,,Medium, +6147,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",outlook.exe,,,,,,,,,1,,=,,Medium, +6148,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6149,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",pptview.exe,,,,,,,,,1,,=,,Medium, +6150,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",spdesign.exe,,,,,,,,,1,,=,,Medium, +6151,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",visio.exe,,,,,,,,,1,,=,,Medium, +6152,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winproj.exe,,,,,,,,,1,,=,,Medium, +6153,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload",winword.exe,,,,,,,,,1,,=,,Medium, +6154,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",excel.exe,,,,,,,,,1,,=,,Medium, +6155,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",exprwd.exe,,,,,,,,,1,,=,,Medium, +6156,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",groove.exe,,,,,,,,,1,,=,,Medium, +6157,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",msaccess.exe,,,,,,,,,1,,=,,Medium, +6158,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mse7.exe,,,,,,,,,1,,=,,Medium, +6159,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",mspub.exe,,,,,,,,,1,,=,,Medium, +6160,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",onenote.exe,,,,,,,,,1,,=,,Medium, +6161,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",outlook.exe,,,,,,,,,1,,=,,Medium, +6162,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6163,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",pptview.exe,,,,,,,,,1,,=,,Medium, +6164,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",spdesign.exe,,,,,,,,,1,,=,,Medium, +6165,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",visio.exe,,,,,,,,,1,,=,,Medium, +6166,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winproj.exe,,,,,,,,,1,,=,,Medium, +6167,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck",winword.exe,,,,,,,,,1,,=,,Medium, +6168,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",excel.exe,,,,,,,,,1,,=,,Medium, +6169,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",exprwd.exe,,,,,,,,,1,,=,,Medium, +6170,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",groove.exe,,,,,,,,,1,,=,,Medium, +6171,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",msaccess.exe,,,,,,,,,1,,=,,Medium, +6172,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mse7.exe,,,,,,,,,1,,=,,Medium, +6173,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",mspub.exe,,,,,,,,,1,,=,,Medium, +6174,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",onenote.exe,,,,,,,,,1,,=,,Medium, +6175,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",outlook.exe,,,,,,,,,1,,=,,Medium, +6176,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",powerpnt.exe,,,,,,,,,1,,=,,Medium, +6177,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",pptview.exe,,,,,,,,,1,,=,,Medium, +6178,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",spdesign.exe,,,,,,,,,1,,=,,Medium, +6179,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",visio.exe,,,,,,,,,1,,=,,Medium, +6180,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winproj.exe,,,,,,,,,1,,=,,Medium, +6181,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",Registry,,"HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions",winword.exe,,,,,,,,,1,,=,,Medium, +6182,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",Registry,,"HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility",Comment,,,,,,,,,"Block all Flash activation",,=,,Medium, +6183,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,enablesiphighsecuritymode,,,,,,,,,1,,=,,Medium, +6184,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",Registry,,HKLM:\software\policies\microsoft\office\16.0\lync,disablehttpconnect,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_user.csv b/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_user.csv new file mode 100644 index 0000000..71397d9 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_office_365_v1908_user.csv @@ -0,0 +1,135 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +5046,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\access,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5047,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\excel,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5048,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\infopath,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5049,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\outlook,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5050,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\powerpoint,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5051,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\project,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5052,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\publisher,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5053,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\visio,noextensibilitycustomizationfromdocument,,,,,,,,,0,,=,,Medium, +5054,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\toolbars\word,noextensibilitycustomizationfromdocument,,,,,,,,,1,,=,,Medium, +5003,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\access\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5000,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5001,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5002,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\access\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5045,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5039,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,enabledatabasefileprotectedview,,,,,,,,,1,,=,,Medium, +5022,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium, +5011,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options\binaryoptions,fupdateext_78_1,,,,,,,,,0,,=,,Medium, +5019,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5013,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublish,,,,,,,,,1,,=,,Medium, +5020,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5040,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5041,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5014,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,disableautorepublishwarning,,,,,,,,,0,,=,,Medium, +5010,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\options,extractdatadisableui,,,,,,,,,1,,=,,Medium, +5023,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium, +5024,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium, +5026,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,difandsylkfiles,,,,,,,,,2,,=,,Medium, +5027,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2macros,,,,,,,,,2,,=,,Medium, +5028,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl2worksheets,,,,,,,,,2,,=,,Medium, +5029,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3macros,,,,,,,,,2,,=,,Medium, +5030,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl3worksheets,,,,,,,,,2,,=,,Medium, +5031,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4macros,,,,,,,,,2,,=,,Medium, +5032,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4workbooks,,,,,,,,,2,,=,,Medium, +5033,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl4worksheets,,,,,,,,,2,,=,,Medium, +5034,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl95workbooks,,,,,,,,,2,,=,,Medium, +5035,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl9597workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5036,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,xl97workbooksandtemplates,,,,,,,,,2,,=,,Medium, +5037,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5038,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,htmlandxmlssfiles,,,,,,,,,2,,=,,Medium, +5025,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\fileblock,dbasefiles,,,,,,,,,2,,=,,Medium, +5015,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,extensionhardening,,,,,,,,,2,,=,,Medium, +5012,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\internet,donotloadpictures,,,,,,,,,1,,=,,Medium, +5016,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,excelbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5043,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5042,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5044,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5017,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5021,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5018,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,webservicefunctionwarnings,,,,,,,,,1,,=,,Medium, +5096,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowactivexoneoffforms,,,,,,,,,0,,=,,Medium, +5116,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailenablelinks,,,,,,,,,0,,=,,Medium, +5108,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,enableoneoffformscripts,,,,,,,,,0,,=,,Medium, +5104,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,allowuserstolowerattachments,,,,,,,,,0,,=,,Medium, +5090,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,authenticationservice,,,,,,,,,16,,=,,Medium, +5111,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomformulaaccess,,,,,,,,,0,,=,,Medium, +5110,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressbookaccess,,,,,,,,,0,,=,,Medium, +5112,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsaveas,,,,,,,,,0,,=,,Medium, +5113,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomaddressinformationaccess,,,,,,,,,0,,=,,Medium, +5114,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoommeetingtaskrequestresponse,,,,,,,,,0,,=,,Medium, +5115,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomsend,,,,,,,,,0,,=,,Medium, +5105,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,showlevel1attach,,,,,,,,,0,,=,,Medium, +5092,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publicfolderscript,,,,,,,,,0,,=,,Medium, +5093,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,sharedfolderscript,,,,,,,,,0,,=,,Medium, +5099,"Office 2016 / Office 365","Microsoft Outlook: Do not display 'Publish to GAL' button",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,publishtogaldisabled,,,,,,,,,1,,=,,Medium, +5091,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\rpc,enablerpcencryption,,,,,,,,,1,,=,,Medium, +5098,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,internet,,,,,,,,,0,,=,,Medium, +5095,"Office 2016 / Office 365","Microsoft Outlook: Junk E-mail protection level",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\mail,junkmailprotection,,,,,,,,,3,,=,,Medium, +5100,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,minenckey,,,,,,,,,168,,=,,Medium, +5103,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,adminsecuritymode,,,,,,,,,3,,=,,Medium, +5097,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook,disallowattachmentcustomization,,,,,,,,,1,,=,,Medium, +5106,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel1,,,,,,,,,;,,=,,Medium, +5107,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,fileextensionsremovelevel2,,,,,,,,,;,,=,,Medium, +5102,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,usecrlchasing,,,,,,,,,1,,=,,Medium, +5117,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,level,,,,,,,,,3,,=,,Medium, +5109,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,promptoomcustomaction,,,,,,,,,0,,=,,Medium, +5101,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\security,warnaboutinvalid,,,,,,,,,1,,=,,Medium, +5094,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\options\general,msgformat,,,,,,,,,0,,=,,Medium, +5143,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5133,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5134,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5138,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5139,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5136,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,binaryfiles,,,,,,,,,2,,=,,Medium, +5130,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,runprograms,,,,,,,,,0,,=,,Medium, +5131,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security,powerpointbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5137,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5141,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5140,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5142,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5132,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\powerpoint\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5135,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5150,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5151,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5152,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",Registry,,"HKCU:\software\policies\microsoft\office\16.0\ms project\security",vbawarnings,,,,,,,2,,3,,>=,,Medium, +5161,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5160,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecuritypublisher,,,,,,,,,2,,=,,Medium, +5162,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\publisher\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5170,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\visio\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5171,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,blockcontentexecutionfrominternet,,,,,,,,,1,,=,,Medium, +5172,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5174,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2000files,,,,,,,,,2,,=,,Medium, +5175,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio2003files,,,,,,,,,2,,=,,Medium, +5176,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security\fileblock,visio50andearlierfiles,,,,,,,,,2,,=,,Medium, +5173,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\software\policies\microsoft\office\16.0\visio\security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5209,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",Registry,,"HKCU:\software\policies\microsoft\office\16.0\word\security\trusted locations",allownetworklocations,,,,,,,,,0,,=,,Medium, +5191,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium, +5192,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,notbpromptunsignedaddin,,,,,,,,,1,,=,,Medium, +5204,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableinternetfilesinpv,,,,,,,,,0,,=,,Medium, +5205,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableunsafelocationsinpv,,,,,,,,,0,,=,,Medium, +5195,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,openinprotectedview,,,,,,,,,0,,=,,Medium, +5196,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2files,,,,,,,,,2,,=,,Medium, +5197,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2000files,,,,,,,,,2,,=,,Medium, +5198,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2003files,,,,,,,,,2,,=,,Medium, +5199,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word2007files,,,,,,,,,2,,=,,Medium, +5200,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word60files,,,,,,,,,2,,=,,Medium, +5201,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word95files,,,,,,,,,2,,=,,Medium, +5202,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,word97files,,,,,,,,,2,,=,,Medium, +5203,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\fileblock,wordxpfiles,,,,,,,,,2,,=,,Medium, +5193,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security,wordbypassencryptedmacroscan,,,,,,,,,0,,=,,Medium, +5207,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,openinprotectedview,,,,,,,,,1,,=,,Medium, +5206,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,disableeditfrompv,,,,,,,,,1,,=,,Medium, +5208,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\protectedview,disableattachmentsinpv,,,,,,,,,0,,=,,Medium, +5190,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",Registry,,HKCU:\software\policies\microsoft\office\16.0\word\security\filevalidation,enableonload,,,,,,,,,1,,=,,Medium, +5194,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,3,,>=,,Medium, +5070,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",Registry,,HKCU:\software\policies\microsoft\office\common\security,uficontrols,,,,,,,,,6,,=,,Medium, +5078,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",Registry,,"HKCU:\software\policies\microsoft\office\16.0\common\security\trusted locations","allow user locations",,,,,,,,,0,,=,,Medium, +5071,"Office 2016 / Office 365","Security Settings: Automation Security",Registry,,HKCU:\software\policies\microsoft\office\common\security,automationsecurity,,,,,,,,,2,,=,,Medium, +5080,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",Registry,,"HKCU:\software\policies\microsoft\office\common\smart tag",neverloadmanifests,,,,,,,,,1,,=,,Medium, +5072,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\trustcenter,trustbar,,,,,,,,,0,,=,,Medium, +5079,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\portal,linkpublishingdisabled,,,,,,,,,1,,=,,Medium, +5073,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,defaultencryption12,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5074,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,openxmlencryption,,,,,,,,,"Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256",,=,,Medium, +5075,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",Registry,,HKCU:\software\policies\microsoft\vba\security,loadcontrolsinforms,,,,,,,,,1,,=,,Medium, +5077,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,drmencryptproperty,,,,,,,,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv new file mode 100644 index 0000000..79f4977 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv @@ -0,0 +1,367 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10950,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +10951,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,0,,=,,Low, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,0,,=,,Low, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +18.10.59.7,"Administrative Templates: Windows Components","Search: Allow search highlights",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",EnableDynamicContentInWSB,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchHighlights,,,,,,0,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv new file mode 100644 index 0000000..390fc98 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv @@ -0,0 +1,371 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10950,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +10951,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv new file mode 100644 index 0000000..cdbb830 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv @@ -0,0 +1,381 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10206,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10950,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +10951,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv new file mode 100644 index 0000000..d8e08e7 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv @@ -0,0 +1,389 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10627,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10627,"MS Security Guide","LSA Protection",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\Lsa,RunAsPPL,,,,,,,,,1,,=,,Medium, +10628,"MS Security Guide","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10950,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Main,"FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowPasswordManager,,,,,,no,,=,,Medium, +10951,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",Registry,,"HKLM:\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings",PreventCertErrorOverrides,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventCertErrorOverrides,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv new file mode 100644 index 0000000..a3a9bd3 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv @@ -0,0 +1,379 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10951,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverrideForFiles,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv new file mode 100644 index 0000000..3cbf260 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv @@ -0,0 +1,397 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10627,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10661,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10662,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10663,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10664,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10665,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +10666,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10698,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10699,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10700,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11040,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium, +11042,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium, +11043,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11034,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv new file mode 100644 index 0000000..9f3632b --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv @@ -0,0 +1,408 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10627,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,,,,,,,,,1,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10661,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10662,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10663,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10664,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10665,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +10666,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10698,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10701,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,=,,Medium, +10702,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADBackupDSRMPassword,,,,,,,,,1,,=,,Medium, +10703,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +10699,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10700,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11058,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableLocalAdminMerge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DisableLocalAdminMerge,,,,,,0,,=,,Medium, +11059,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11061,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableRoutinelyTakingAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableRoutinelyTakingAction,,,,,,0,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,3,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11062,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpBafsExtendedTimeout,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpBafsExtendedTimeout,,,,0,,50,,=,,Medium, +11063,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11064,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",RealtimeScanDirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_RealtimeScanDirection,,,,,,0,,=|0,,Medium, +11065,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableOnAccessProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableOnAccessProtection,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11067,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScanOnRealtimeEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,RealtimeProtection_DisableScanOnRealtimeEnable,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11066,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11040,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium, +11042,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium, +11043,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10952,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,AllowSmartScreen,,,,,,1,,=,,Medium, +10953,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",Registry,,HKLM:\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter,PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,,,1,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11034,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv new file mode 100644 index 0000000..65414ed --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv @@ -0,0 +1,438 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10232,"Security Options","User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorEnhancedAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection,,,,,,1,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10233,"Security Options","User Account Control: Configure type of Admin Approval Mode Admin approval mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,TypeOfAdminApprovalMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_TypeOfAdminApprovalMode,,,,,,2,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,2,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10710,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10711,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10712,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10713,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10714,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10715,"Administrative Templates: Network","Lanman Server: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10716,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10717,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10720,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10721,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10722,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10723,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10724,"Administrative Templates: Network","Lanman Workstation: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10725,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10726,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10661,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10662,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10663,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10664,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10665,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium, +10666,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +10669,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10698,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10730,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10731,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,0,,=,,Medium, +10732,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10733,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10734,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10735,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10736,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,0,,=,,Medium, +10737,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10738,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10739,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10701,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,=,,Medium, +10702,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADBackupDSRMPassword,,,,,,,,,1,,=,,Medium, +10703,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +10699,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10700,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10768,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11058,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableLocalAdminMerge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DisableLocalAdminMerge,,,,,,0,,=,,Medium, +11068,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium, +11059,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11061,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableRoutinelyTakingAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableRoutinelyTakingAction,,,,,,0,,=,,Medium, +11069,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,3,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11062,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpBafsExtendedTimeout,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpBafsExtendedTimeout,,,,0,,50,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium, +11064,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",RealtimeScanDirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_RealtimeScanDirection,,,,,,0,,=|0,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11065,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableOnAccessProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableOnAccessProtection,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11067,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScanOnRealtimeEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,RealtimeProtection_DisableScanOnRealtimeEnable,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +11066,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisablePackedExeScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Scan_DisablePackedExeScanning,,,,,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11040,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium, +11042,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium, +11043,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11034,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv new file mode 100644 index 0000000..69b1ea2 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv @@ -0,0 +1,439 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10232,"Security Options","User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorEnhancedAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection,,,,,,1,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10233,"Security Options","User Account Control: Configure type of Admin Approval Mode Admin approval mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,TypeOfAdminApprovalMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_TypeOfAdminApprovalMode,,,,,,2,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10710,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10711,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10712,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10713,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10714,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10715,"Administrative Templates: Network","Lanman Server: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10716,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10717,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10720,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10721,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10722,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10723,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10724,"Administrative Templates: Network","Lanman Workstation: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10725,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10726,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10661,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10662,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10663,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10664,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10665,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium, +10666,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +10669,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +10704,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10698,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10730,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10731,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,0,,=,,Medium, +10732,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10733,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10734,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10735,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10736,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,0,,=,,Medium, +10737,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10738,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10739,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10701,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,=,,Medium, +10702,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADBackupDSRMPassword,,,,,,,,,1,,=,,Medium, +10703,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +10699,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10700,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10768,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +10932,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11058,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableLocalAdminMerge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DisableLocalAdminMerge,,,,,,0,,=,,Medium, +11059,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11061,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableRoutinelyTakingAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableRoutinelyTakingAction,,,,,,0,,=,,Medium, +11069,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,3,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,2,,=,,Medium, +11045,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,2,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11062,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpBafsExtendedTimeout,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpBafsExtendedTimeout,,,,0,,50,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium, +11064,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",RealtimeScanDirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_RealtimeScanDirection,,,,,,0,,=|0,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11065,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableOnAccessProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableOnAccessProtection,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11067,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScanOnRealtimeEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,RealtimeProtection_DisableScanOnRealtimeEnable,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11040,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium, +11042,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium, +11043,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11034,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv new file mode 100644 index 0000000..c16906f --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv @@ -0,0 +1,439 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,10,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10232,"Security Options","User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorEnhancedAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministratorProtection,,,,,,1,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10233,"Security Options","User Account Control: Configure type of Admin Approval Mode Admin approval mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,TypeOfAdminApprovalMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_TypeOfAdminApprovalMode,,,,,,2,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"BUILTIN\Remote Desktop Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10507,"Windows Firewall","Display a notification (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10509,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10511,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10513,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10521,"Windows Firewall","Display a notification (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10523,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10525,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10527,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10535,"Windows Firewall","Display a notification (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DisableNotifications,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DisableInboundNotifications,,,,0,,1,,=,,Low, +10537,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalPolicyMerge,,,,0,,0,,=,,Low, +10538,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,AllowLocalIPsecPolicyMerge,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,AllowLocalIpsecPolicyMerge,,,,0,,0,,=,,Low, +10539,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium, +10541,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium, +10543,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10710,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10711,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10712,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10713,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10714,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10715,"Administrative Templates: Network","Lanman Server: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10716,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10717,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10720,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10721,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10722,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10723,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10724,"Administrative Templates: Network","Lanman Workstation: Mandate the maximum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MaxSmb2Dialect,,,,,,,,,785,,=,,Medium, +10725,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10726,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,0,,=,,Medium, +10652,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10655,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy,fBlockNonDomain,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsConnectionManager,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsConnectionManager,ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork,,,,0,,1,,=,,Medium, +10656,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium, +10660,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium, +10661,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10662,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10663,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10664,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10665,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium, +10705,"Administrative Templates: Printers","Configure Windows Ready Print driver ranking",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\DriverRanking",UseWindowsReadyPrintDriverRankingGroupPolicy,,,,,,,,,1,,=,,Medium, +10666,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium, +10669,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +10704,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10698,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureKernelShadowStacksLaunch,,,,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium, +10679,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10683,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium, +10684,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium, +10730,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10731,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,0,,=,,Medium, +10732,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10733,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10734,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10735,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10736,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,0,,=,,Medium, +10737,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10738,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10739,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10701,"Administrative Templates: System","LAPS: Configure password backup directory",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,BackupDirectory,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,BackupDirectory,,,,,,2,,=,,Medium, +10702,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADBackupDSRMPassword,,,,,,,,,1,,=,,Medium, +10703,"Administrative Templates: System","LAPS: Enable password encryption",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS,ADPasswordEncryptionEnabled,HKLM:\SOFTWARE\Microsoft\Policies\LAPS,,ADPasswordEncryptionEnabled,,,,,,1,,=,,Medium, +10699,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10700,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10687,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium, +10688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium, +10689,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium, +10690,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium, +10691,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium, +10692,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium, +10693,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiry,,,,,,,,,,,=,,Medium, +10694,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",MaxTicketExpiryUnits,,,,,,,,,,,=,,Medium, +10695,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fUseMailto,,,,,,,,,,,=,,Medium, +10696,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowFullControl,,,,,,,,,,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10750,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium, +10751,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,MSAOptional,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppRuntime,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppRuntime,AllowMicrosoftAccountsToBeOptional,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10756,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium, +10757,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium, +10758,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",Registry,,HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE,RDVDenyWriteAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RDVDenyWriteAccess_Name,,,,,,1,,=,,Medium, +10759,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",Registry,,HKLM:\Software\Policies\Microsoft\FVE,RDVDenyCrossOrg,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,RemovableDrivesRequireEncryption,,,,,,0,,=,,Medium, +10760,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium, +10762,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10768,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +10932,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,10240,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11058,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableLocalAdminMerge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,DisableLocalAdminMerge,,,,,,0,,=,,Medium, +11059,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11061,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableRoutinelyTakingAction,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableRoutinelyTakingAction,,,,,,0,,=,,Medium, +11069,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Features",PassiveRemediation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PassiveRemediation,,,,0,,1,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,3,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,2,,=,,Medium, +11045,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,2,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11062,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpBafsExtendedTimeout,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpBafsExtendedTimeout,,,,0,,50,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\NIS",EnableConvertWarnToBlock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableConvertWarnToBlock,,,,0,,1,,=,,Medium, +11064,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",RealtimeScanDirection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_RealtimeScanDirection,,,,,,0,,=|0,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11065,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableOnAccessProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableOnAccessProtection,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11067,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScanOnRealtimeEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,RealtimeProtection_DisableScanOnRealtimeEnable,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11040,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyMalicious,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyMalicious,,,,,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyPasswordReuse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyPasswordReuse,,,,,,1,,=,,Medium, +11042,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,NotifyUnsafeApp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,NotifyUnsafeApp,,,,,,1,,=,,Medium, +11043,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WTDS\Components,ServiceEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WebThreatDefense,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WebThreatDefense,ServiceEnabled,,,,,,1,,=,,Medium, +10951,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10954,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11000,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11034,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, +11060,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium, +11050,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium, +11051,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, +11052,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium, +11053,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium, +11054,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium, +11055,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium, +11056,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium, +11057,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv b/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv new file mode 100644 index 0000000..63bc318 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv @@ -0,0 +1,6 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium, +10001,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium, +10002,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, +10003,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Control Panel","FormSuggest Passwords",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,1,,=,,Medium, +10004,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",Registry,,"HKCU:\Software\Policies\Microsoft\Internet Explorer\Main","FormSuggest PW Ask",HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\InternetExplorer,AllowAutoComplete,,,,,,no,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv new file mode 100644 index 0000000..340c1b5 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv @@ -0,0 +1,321 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,0,,=,,Low, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,0,,=,,Low, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv new file mode 100644 index 0000000..316b8e0 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv @@ -0,0 +1,322 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Network Connections",NC_ShowSharedAccessUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowInternetSharing,,,,1,,0,,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,0,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,0,,=,,Low, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,0,,=,,Low, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10994,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv new file mode 100644 index 0000000..8fc2fd3 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv @@ -0,0 +1,329 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10206,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv new file mode 100644 index 0000000..23120a2 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv @@ -0,0 +1,329 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10206,"Security Options","Domain member: Maximum machine account password age",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_MaximumMachineAccountPasswordAge,,,,30,,30,,<=!0,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11028,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv new file mode 100644 index 0000000..97b0cb3 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv @@ -0,0 +1,355 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements Enforcement",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerEnforceIntegrity,,,,,,,,,1,,=,,Medium, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators",,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10627,"MS Security Guide","Add Extended Protection for LDAP Authentication (Domain Controllers only)",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,,,2,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv new file mode 100644 index 0000000..b5f7e0b --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv @@ -0,0 +1,350 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,1,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11032,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalUsers,,,,0,,1,,=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv new file mode 100644 index 0000000..b297bc0 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv @@ -0,0 +1,355 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements Enforcement",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerEnforceIntegrity,,,,,,,,,1,,=,,Medium, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators",,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10325,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10429,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10627,"MS Security Guide","Add Extended Protection for LDAP Authentication (Domain Controllers only)",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,,,2,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv new file mode 100644 index 0000000..b2e80f4 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv @@ -0,0 +1,349 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account and member of Administrators group;BUILTIN\Guests",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10678,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,1,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv new file mode 100644 index 0000000..7952d56 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv @@ -0,0 +1,363 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements Enforcement",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerEnforceIntegrity,,,,,,,,,1,,=,,Medium, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10234,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +10235,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium, +10236,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators",,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10325,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,BUILTIN\Guests,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10429,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10627,"MS Security Guide","Add Extended Protection for LDAP Authentication (Domain Controllers only)",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,,,2,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10679,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10683,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10684,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +10678,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10717,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM,SamNGCKeyROCAValidation,,,,,,,,,2,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10768,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +10769,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv new file mode 100644 index 0000000..278b850 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv @@ -0,0 +1,355 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,3,,<=,,Low, +10003,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10232,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium, +10233,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account and member of Administrators group;BUILTIN\Guests",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;RESTRICTED SERVICES\PrintSpoolerService",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Authorization Policy Change",auditpol,{0CCE9231-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10626,"MS Security Guide","Limits print driver installation to Administrators",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,,,,,,,,,1,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10655,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10656,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10657,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10658,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10659,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium, +10660,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10661,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10662,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,=,,Medium, +10663,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium, +10664,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium, +10665,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10666,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium, +10667,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,768,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1,RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10717,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium, +10718,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,1,,=,,Medium, +10667,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium, +10668,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,=,,Medium, +10669,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium, +10719,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium, +10678,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10698,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITHashAlgorithmConfigurationEnabled,,,,,,,,,1,,=,,Medium, +10690,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA1,,,,,,,,,1,,=,,Medium, +10700,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA256,,,,,,,,,3,,=,,Medium, +10701,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA384,,,,,,,,,3,,=,,Medium, +10702,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters,PKINITSHA512,,,,,,,,,3,,=,,Medium, +10705,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITHashAlgorithmConfigurationEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmConfiguration,,,,,,1,,=,,Medium, +10706,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA1,,,,,,1,,=,,Medium, +10707,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA256,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA256,,,,,,3,,=,,Medium, +10708,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA384,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA384,,,,,,3,,=,,Medium, +10709,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,PKINITSHA512,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Kerberos,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Kerberos,PKInitHashAlgorithmSHA512,,,,,,3,,=,,Medium, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10715,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,1,,=,,Medium, +10716,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,1,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10768,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableMotWOnInsecurePathCopy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,DisableMotWOnInsecurePathCopy,,,,0,,0,,=,,Medium, +10769,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +11033,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",HideExclusionsFromLocalAdmins,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,HideExclusionsFromLocalAdmins,,,,,,1,,=,,Medium, +11034,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",SignaturesRing,,,,,,,,,5,,=,,Medium, +11035,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",EngineRing,,,,,,,,,5,,=,,Medium, +11036,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PlatformRing,,,,,,,,,5,,=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +11037,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",a8f5898e-1dc8-49a9-9878-85004b8a61e6,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11038,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",MpPreferenceAsr,a8f5898e-1dc8-49a9-9878-85004b8a61e6,,,,,,,,,0,,1,,=,,Medium, +11039,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11040,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium, +11041,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",AllowNetworkProtectionOnWinServer,,,,,,,0,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11042,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",OobeEnableRtpAndSigUpdate,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,OobeEnableRtpAndSigUpdate,,,,1,,1,,=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +11031,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium, +11043,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting",EnableDynamicSignatureDroppedEventReporting,,,,,,,,,1,,=,,Medium, +11044,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",QuickScanIncludeExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,QuickScanIncludeExclusions,,,,0,,1,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +11045,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +11046,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11013,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv new file mode 100644 index 0000000..1584bdb --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv @@ -0,0 +1,326 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10232,"Security Options","Domain controller: LDAP server channel binding token requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LdapEnforceChannelBinding,,,,,,,1,,2,,=,,Medium, +10233,"Security Options","Domain controller: LDAP server signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\NTDS\Parameters,LDAPServerIntegrity,,,,,,,1,,2,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS;BUILTIN\Administrators;NT AUTHORITY\Authenticated Users",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10324,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",accesschk,SeRemoteInteractiveLogonRight,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,BUILTIN\Administrators,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10423,"Advanced Audit Policy Configuration","Kerberos Authentication Service",auditpol,{0CCE9242-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10424,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",auditpol,{0CCE9240-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10425,"Advanced Audit Policy Configuration","Computer Account Management",auditpol,{0CCE9236-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10426,"Advanced Audit Policy Configuration","Other Account Management Events",auditpol,{0CCE923A-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10427,"Advanced Audit Policy Configuration","Directory Service Access",auditpol,{0CCE923B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10428,"Advanced Audit Policy Configuration","Directory Service Changes",auditpol,{0CCE923C-69AE-11D9-BED3-505054503030},,,,,,,,,,,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,0,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv b/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv new file mode 100644 index 0000000..aaf2c09 --- /dev/null +++ b/vendor/lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv @@ -0,0 +1,326 @@ +ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter +10000,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10001,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low, +10002,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low, +10100,"Account Policies","Length of password history maintained",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,DevicePasswordHistory,,,,None,,24,,>=,,Low, +10101,"Account Policies","Minimum password length",accountpolicy,,,,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,MinDevicePasswordLength,,,,0,,14,,>=,,Medium, +10102,"Account Policies","Password must meet complexity requirements",secedit,"System Access\PasswordComplexity",,,,,,,,,0,,1,,=,,Medium, +10103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High, +10200,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LimitBlankPasswordUse,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly,,,,1,,1,,=,,Medium, +10201,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low, +10202,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireSignOrSeal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways,,,,1,,1,,=,,Medium, +10203,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SealSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallyEncryptSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10204,"Security Options","Domain member: Digitally sign secure channel data (when possible)",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,SignSecureChannel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DigitallySignSecureChannelDataWhenPossible,,,,1,,1,,=,,Medium, +10205,"Security Options","Domain member: Disable machine account password changes",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_DisableMachineAccountPasswordChanges,,,,0,,0,,=,,Medium, +10207,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,RequireStrongKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,DomainMember_RequireStrongSessionKey,,,,1,,1,,=,,Medium, +10208,"Security Options","Interactive logon: Machine inactivity limit",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,InactivityTimeoutSecs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_MachineInactivityLimit,,,,900,,900,,=,,Low, +10209,"Security Options","Interactive logon: Smart card removal behavior",Registry,,"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon",ScRemoveOption,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_SmartCardRemovalBehavior,,,,0,,1,,=,,Low, +10210,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10211,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium, +10212,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium, +10213,"Security Options","Network access: Allow anonymous SID/Name translation",secedit,"System Access\LSAAnonymousNameLookup",,,,,,,,,0,,0,,=,,Medium, +10214,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium, +10215,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium, +10216,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium, +10217,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium, +10218,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium, +10219,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High, +10220,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium, +10221,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium, +10222,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium, +10223,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium, +10224,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",Registry,,"HKLM:\System\CurrentControlSet\Control\Session Manager",ProtectionMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,SystemObjects_StrengthenDefaultPermissionsOfInternalSystemObjects,,,,1,,1,,=,,Medium, +10225,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium, +10226,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium, +10227,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,0,,=,,Medium, +10228,"Security Options","User Account Control: Detect application installations and prompt for elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableInstallerDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_DetectApplicationInstallationsAndPromptForElevation,,,,1,,1,,=,,Medium, +10229,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecureUIAPaths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations,,,,1,,1,,=,,Medium, +10230,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableLUA,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_RunAllAdministratorsInAdminApprovalMode,,,,1,,1,,=,,Medium, +10231,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,EnableVirtualization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations,,,,1,,1,,=,,Medium, +10301,"User Rights Assignment","Access Credential Manager as a trusted caller",accesschk,SeTrustedCredManAccessPrivilege,,,,,,,,,,,,,=,,Medium, +10302,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,"NT AUTHORITY\Authenticated Users;BUILTIN\Administrators",,=,,Medium, +10303,"User Rights Assignment","Act as part of the operating system",accesschk,SeTcbPrivilege,,,,,,,,,,,,,=,,Medium, +10304,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Administrators,,=,,Medium, +10305,"User Rights Assignment","Back up files and directories",accesschk,SeBackupPrivilege,,,,,,,,,"BUILTIN\Administrators;BUILTIN\Backup Operators",,BUILTIN\Administrators,,=,,Medium, +10306,"User Rights Assignment","Create a pagefile",accesschk,SeCreatePagefilePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10307,"User Rights Assignment","Create a token object",accesschk,SeCreateTokenPrivilege,,,,,,,,,,,,,=,,Medium, +10308,"User Rights Assignment","Create global objects",accesschk,SeCreateGlobalPrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10309,"User Rights Assignment","Create permanent shared objects",accesschk,SeCreatePermanentPrivilege,,,,,,,,,,,,,=,,Medium, +10310,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10311,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"NT AUTHORITY\Local account and member of Administrators group",,=,,Medium, +10312,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"NT AUTHORITY\Local account",,=,,Medium, +10313,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",accesschk,SeEnableDelegationPrivilege,,,,,,,,,,,,,=,,Medium, +10314,"User Rights Assignment","Force shutdown from a remote system",accesschk,SeRemoteShutdownPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10315,"User Rights Assignment","Impersonate a client after authentication",accesschk,SeImpersonatePrivilege,,,,,,,,,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,"NT AUTHORITY\SERVICE;BUILTIN\Administrators;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE",,=,,Medium, +10316,"User Rights Assignment","Load and unload device drivers",accesschk,SeLoadDriverPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10317,"User Rights Assignment","Lock pages in memory",accesschk,SeLockMemoryPrivilege,,,,,,,,,,,,,=,,Medium, +10318,"User Rights Assignment","Manage auditing and security log",accesschk,SeSecurityPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10319,"User Rights Assignment","Modify firmware environment values",accesschk,SeSystemEnvironmentPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10320,"User Rights Assignment","Perform volume maintenance tasks",accesschk,SeManageVolumePrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10321,"User Rights Assignment","Profile single process",accesschk,SeProfileSingleProcessPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10322,"User Rights Assignment","Restore files and directories",accesschk,SeRestorePrivilege,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Administrators",,BUILTIN\Administrators,,=,,Medium, +10323,"User Rights Assignment","Take ownership of files or other objects",accesschk,SeTakeOwnershipPrivilege,,,,,,,,,BUILTIN\Administrators,,BUILTIN\Administrators,,=,,Medium, +10400,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10401,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10402,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low, +10403,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10404,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10405,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low, +10406,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10407,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10408,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10409,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10410,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10411,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10412,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10413,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10414,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10415,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10416,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10417,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low, +10418,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low, +10419,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10420,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low, +10421,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low, +10422,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low, +10501,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10503,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10505,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10515,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10517,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10519,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10529,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium, +10531,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium, +10533,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium, +10600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low, +10601,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenSlideshow,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenSlideShow,,,,0,,1,,=,,Low, +10610,"Administrative Templates: LAPS","Enable local admin password management",Registry,,"HKLM:\Software\Policies\Microsoft Services\AdmPwd",AdmPwdEnabled,,,,,,,0,,1,,=,,Medium, +10620,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ApplyUACRestrictionsToLocalAccountsOnNetworkLogon,,,,,,0,,=,,Medium, +10621,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium, +10622,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium, +10623,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium, +10624,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium, +10625,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High, +10640,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium, +10641,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium, +10642,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium, +10643,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium, +10650,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium, +10651,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium, +10653,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\NETLOGON,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10654,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths,\\*\SYSVOL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,HardenedUNCPaths,,,,,,"RequireMutualAuthentication=1, RequireIntegrity=1",,=,,Medium, +10670,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium, +10671,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium, +10672,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,EnableVirtualizationBasedSecurity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,EnableVirtualizationBasedSecurity,,,,,,1,,=,,Medium, +10673,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HypervisorEnforcedCodeIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\VirtualizationBasedTechnology,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\VirtualizationBasedTechnology,HypervisorEnforcedCodeIntegrity,,,,,,1,,=,,Medium, +10674,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,LsaCfgFlags,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,LsaCfgFlags,,,,,,1,,=,,Medium, +10675,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,RequirePlatformSecurityFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,RequirePlatformSecurityFeatures,,,,,,1,,=,,Medium, +10676,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium, +10677,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium, +10680,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium, +10681,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low, +10682,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low, +10685,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium, +10686,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,EnumerateLocalUsers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnumerateLocalUsersOnDomainJoinedComputers,,,,0,,0,,=,,Medium, +10697,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,1,,=,,Medium, +10752,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium, +10753,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium, +10754,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium, +10755,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium, +10763,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium, +10764,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium, +10765,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium, +10766,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium, +10767,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium, +10800,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverride,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverride,,,,,,1,,=,,Medium, +10801,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",PreventOverrideAppRepUnknown,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableSafetyFilterOverrideForAppRepUnknown,,,,,,1,,=,,Medium, +10802,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\PhishingFilter",EnabledV9,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Managing_Safety_Filter_IE9,,,,,,1,,=,,Medium, +10803,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX",BlockNonAdminActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisablePerUserActiveXInstall,,,,,,1,,=,,Medium, +10804,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_zones_map_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_zones_map_edit,,,,,,1,,=,,Medium, +10805,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_options_edit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_options_edit,,,,,,1,,=,,Medium, +10806,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",Security_HKLM_only,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Security_HKLM_only,,,,,,1,,=,,Medium, +10807,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AxInstaller,OnlyUseAXISForActiveXInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,OnlyUseAXISForActiveXInstall,,,,,,1,,=,,Medium, +10808,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Restrictions",NoCrashDetection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,AddonManagement_RestrictCrashDetection,,,,,,1,,=,,Medium, +10809,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Security",DisableSecuritySettingsCheck,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Disable_Security_Settings_Check,,,,,,0,,=,,Medium, +10810,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",PreventIgnoreCertErrors,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,NoCertError,,,,,,1,,=,,Medium, +10811,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",RunInvalidSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_InvalidSignatureBlock,,,,,,0,,=,,Medium, +10812,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",CertificateRevocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_CertificateRevocation,,,,,,1,,=,,Medium, +10813,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Download",CheckExeSignatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DownloadSignatures,,,,,,yes,,=,,Medium, +10814,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableEPMCompat,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_DisableEPMCompat,,,,,,1,,=,,Medium, +10815,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",SecureProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_SetWinInetProtocols,,,,,,2560,,=,,Medium, +10816,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation64Bit,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode64Bit,,,,,,1,,=,,Medium, +10817,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",Isolation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableEnhancedProtectedMode,,,,,,PMEM,,=,,Medium, +10818,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap",UNCAsIntranet,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_UNCAsIntranet,,,,,,0,,=,,Medium, +10819,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",WarnOnBadCertRecving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWarnCertMismatch,,,,,,1,,=,,Medium, +10820,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_1,,,,,,3,,=,,Medium, +10821,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_1,,,,,,3,,=,,Medium, +10822,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_1,,,,,,3,,=,,Medium, +10823,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_1,,,,,,3,,=,,Medium, +10824,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet,,,,,,3,,=,,Medium, +10825,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Internet,,,,,,3,,=,,Medium, +10826,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_1,,,,,,3,,=,,Medium, +10827,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_1,,,,,,3,,=,,Medium, +10828,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_1,,,,,,3,,=,,Medium, +10829,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_1,,,,,,3,,=,,Medium, +10830,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_1,,,,,,3,,=,,Medium, +10831,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_1,,,,,,3,,=,,Medium, +10832,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_1,,,,,,0,,=,,Medium, +10833,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_1,,,,,,3,,=,,Medium, +10834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_1,,,,,,3,,=,,Medium, +10835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet,,,,,,3,,=,,Medium, +10836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet,,,,,,3,,=,,Medium, +10837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_1,,,,,,3,,=,,Medium, +10838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_1,,,,,,3,,=,,Medium, +10839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_1,,,,,,0,,=,,Medium, +10840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_1,,,,,,3,,=,,Medium, +10841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_1,,,,,,65536,,=,,Medium, +10842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_1,,,,,,3,,=,,Medium, +10843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_1,,,,,,3,,=,,Medium, +10845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_1,,,,,,1,,=,,Medium, +10846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Internet,,,,,,0,,=,,Medium, +10847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_1,,,,,,0,,=,,Medium, +10848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_1,,,,,,0,,=,,Medium, +10849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_1,,,,,,0,,=,,Medium, +10850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_1,,,,,,3,,=,,Medium, +10851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_1,,,,,,3,,=,,Medium, +10852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_3,,,,,,0,,=,,Medium, +10853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_3,,,,,,3,,=,,Medium, +10854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_3,,,,,,65536,,=,,Medium, +10855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_9,,,,,,0,,=,,Medium, +10856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_9,,,,,,0,,=,,Medium, +10857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_2,,,,,,0,,=,,Medium, +10858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_2,,,,,,0,,=,,Medium, +10859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_10,,,,,,0,,=,,Medium, +10860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_8,,,,,,0,,=,,Medium, +10861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_6,,,,,,0,,=,,Medium, +10863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1406,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAccessDataSourcesAcrossDomains_7,,,,,,3,,=,,Medium, +10864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1400,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyActiveScripting_7,,,,,,3,,=,,Medium, +10865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2000,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBinaryBehaviors_7,,,,,,3,,=,,Medium, +10866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1407,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowPasteViaScript_7,,,,,,3,,=,,Medium, +10867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1802,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDropOrPasteFiles_7,,,,,,3,,=,,Medium, +10868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1803,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyFileDownload_7,,,,,,3,,=,,Medium, +10869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_XAML_7,,,,,,3,,=,,Medium, +10870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1608,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowMETAREFRESH_7,,,,,,3,,=,,Medium, +10871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted,,,,,,3,,=,,Medium, +10872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",120c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowTDCControl_Both_Restricted,,,,,,3,,=,,Medium, +10873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1206,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_WebBrowserControl_7,,,,,,3,,=,,Medium, +10874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2102,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyWindowsRestrictionsURLaction_7,,,,,,3,,=,,Medium, +10875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1209,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_AllowScriptlets_7,,,,,,3,,=,,Medium, +10876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2103,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_ScriptStatusBar_7,,,,,,3,,=,,Medium, +10877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",140C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAllowVBScript_7,,,,,,3,,=,,Medium, +10878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNotificationBarDownloadURLaction_7,,,,,,3,,=,,Medium, +10879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_7,,,,,,0,,=,,Medium, +10880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadSignedActiveX_7,,,,,,3,,=,,Medium, +10881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDownloadUnsignedActiveX_7,,,,,,3,,=,,Medium, +10882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2709,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted,,,,,,3,,=,,Medium, +10883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2708,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted,,,,,,3,,=,,Medium, +10884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",160A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_LocalPathForUpload_7,,,,,,3,,=,,Medium, +10885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_7,,,,,,3,,=,,Medium, +10886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_7,,,,,,0,,=,,Medium, +10887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1804,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLaunchAppsAndFilesInIFRAME_7,,,,,,3,,=,,Medium, +10888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1A00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyLogon_7,,,,,,196608,,=,,Medium, +10889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1607,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyNavigateSubframesAcrossDomains_7,,,,,,3,,=,,Medium, +10890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2004,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUnsignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2001,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicySignedFrameworkComponentsURLaction_7,,,,,,3,,=,,Medium, +10892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1200,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyRunActiveXControls_7,,,,,,3,,=,,Medium, +10893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1405,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXMarkedSafe_7,,,,,,3,,=,,Medium, +10894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1402,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptingOfJavaApplets_7,,,,,,3,,=,,Medium, +10895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1806,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_UnsafeFiles_7,,,,,,3,,=,,Medium, +10896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1409,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyTurnOnXSSFilter_Both_Restricted,,,,,,0,,=,,Medium, +10897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2500,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_TurnOnProtectedMode_7,,,,,,0,,=,,Medium, +10898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2301,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_Policy_Phishing_7,,,,,,0,,=,,Medium, +10899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1809,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyBlockPopupWindows_7,,,,,,0,,=,,Medium, +10900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",1606,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyUserdataPersistence_7,,,,,,3,,=,,Medium, +10901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4",2101,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyZoneElevationURLaction_7,,,,,,3,,=,,Medium, +10902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",270C,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyAntiMalwareCheckingOfActiveXControls_5,,,,,,0,,=,,Medium, +10903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1201,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyScriptActiveXNotMarkedSafe_5,,,,,,3,,=,,Medium, +10904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2",1C00,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IZ_PolicyJavaPermissions_5,,,,,,65536,,=,,Medium, +10905,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",EnableSSL3Fallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,Advanced_EnableSSL3Fallback,,,,,,0,,=,,Medium, +10906,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,RunThisTimeEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisableRunThisTime,,,,,,0,,=,,Medium, +10907,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Ext,VersionCheckEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,VerMgmtDisable,,,,,,1,,=,,Medium, +10908,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10909,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10910,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_5,,,,,,1,,=,,Medium, +10911,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10912,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10913,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_6,,,,,,1,,=,,Medium, +10914,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10915,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10916,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_3,,,,,,1,,=,,Medium, +10917,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10918,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10919,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_10,,,,,,1,,=,,Medium, +10920,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10921,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10922,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_9,,,,,,1,,=,,Medium, +10923,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10924,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10925,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_11,,,,,,1,,=,,Medium, +10926,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10927,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10928,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_12,,,,,,1,,=,,Medium, +10929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",iexplore.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",explorer.exe,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS",(Reserved),HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,IESF_PolicyExplorerProcesses_8,,,,,,1,,=,,Medium, +10960,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium, +10961,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium, +10962,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium, +10963,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium, +10964,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium, +10970,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Feeds",DisableEnclosureDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\InternetExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer,DisableEnclosureDownloading,,,,0,,1,,=,,Medium, +10971,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium, +10972,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium, +10998,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,>=,,Medium, +10973,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium, +10974,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,1,,=,,Medium, +10999,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium, +11013,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium, +11014,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium, +11015,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium, +10976,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium, +10977,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +10978,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium, +10979,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11029,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium, +10980,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11030,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium, +10981,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11016,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium, +10982,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11017,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium, +10983,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11018,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium, +10984,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11019,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium, +10985,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11020,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,0,,=,,Low, +10986,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11021,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium, +10987,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11022,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium, +10988,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,0,,=,,Low, +11023,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,0,,=,,Low, +10989,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11024,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium, +10990,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11025,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium, +10991,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11026,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium, +10992,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium, +11027,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium, +10993,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium, +11001,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,1,,=,,Low, +11002,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium, +11003,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium, +11004,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium, +11005,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium, +11006,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,0,,=,,Low, +11007,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium, +11008,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium, +11009,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium, +11010,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium, +11011,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium, +11012,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium, diff --git a/vendor/lists/finding_list_translation.csv b/vendor/lists/finding_list_translation.csv new file mode 100644 index 0000000..019befb --- /dev/null +++ b/vendor/lists/finding_list_translation.csv @@ -0,0 +1,1901 @@ +Id,CategoryEN,NameEN,Language,Category,Name +1621,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727)",,, +1619,".NET Framework: TLS Settings","Use Strong Crypto (v2.0.50727, 32bit)",,, +1617,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319)",,, +1615,".NET Framework: TLS Settings","Use Strong Crypto (v4.0.30319, 32bit)",,, +1620,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727)",,, +1618,".NET Framework: TLS Settings","Use System Default TLS Versions (v2.0.50727, 32bit)",,, +1616,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319)",,, +1614,".NET Framework: TLS Settings","Use System Default TLS Versions (v4.0.30319, 32bit)",,, +2,"Account Policies","Account lockout duration",DE,Kontorichtlinien,Kontosperrungsdauer +3,"Account Policies","Account lockout threshold",DE,Kontorichtlinien,Kontosperrungsschwelle +1695,"Account Policies","Allow Administrator account lockout",,, +338,"Account Policies","Length of password history maintained",DE,Kontorichtlinien,"Kennwortchronik erzwingen" +339,"Account Policies","Maximum password age",DE,Kontorichtlinien,"Maximales Kennwortalter" +340,"Account Policies","Minimum password age",DE,Kontorichtlinien,"Minimales Kennwortalter" +341,"Account Policies","Minimum password length",DE,Kontorichtlinien,"Minimale Kennwortlänge" +342,"Account Policies","Password must meet complexity requirements",DE,Kontorichtlinien,"Kennwort muss Komplexitätsvoraussetzungen entsprechen" +343,"Account Policies","Relax minimum password length limits",,, +4,"Account Policies","Reset account lockout counter",DE,Kontorichtlinien,"Zurücksetzungsdauer des Kontosperrungszählers" +344,"Account Policies","Store passwords using reversible encryption",DE,Kontorichtlinien,"Kennwort mit umkehrbarer Verschlüsselung speichern" +1937,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable WPAD",,, +1938,"Administrative Templates: Center for Internet Security (CIS)","Additional Benchmark Settings: Disable HTTP proxy features: Disable proxy authentication",,, +530,"Administrative Templates: Control Panel","Allow Online Tips",DE,"Administrative Vorlagen: Systemsteuerung","Onlinetipps zulassen" +735,"Administrative Templates: Control Panel","Enable screen saver",DE,"Administrative Vorlagen: Systemsteuerung","Bildschirmschoner aktivieren" +801,"Administrative Templates: Control Panel","Force specific screen saver: Screen saver executable name",DE,"Administrative Vorlagen: Systemsteuerung","Bestimmten Bildschirmschoner erzwingen" +736,"Administrative Templates: Control Panel","Password protect the screen saver",DE,"Administrative Vorlagen: Systemsteuerung","Kennwortschutz für den Bildschirmschoner verwenden" +98,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",DE,"Administrative Vorlagen: Systemsteuerung","Anpassung: Aktivieren der Sperrbildschirmkamera verhindern" +528,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen slide show",DE,"Administrative Vorlagen: Systemsteuerung","Anpassung: Aktivieren der Diashow auf dem Sperrbildschirm verhindern" +529,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",DE,"Administrative Vorlagen: Systemsteuerung","Regions- und Sprachoptionen: Aktivierung von Online-Spracherkennungsdiensten durch den Benutzer zulassen" +1551,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitInkCollection)",DE,"Administrative Vorlagen: Systemsteuerung","Regions- und Sprachanpassung: Handschriftanpassung: Automatisches Lernen deaktivieren (RestrictImplicitInkCollection)" +1552,"Administrative Templates: Control Panel","Regional and Language Options: Handwriting personalization: Turn off automatic learning (RestrictImplicitTextCollection)",DE,"Administrative Vorlagen: Systemsteuerung","Regions- und Sprachanpassung: Handschriftanpassung: Automatisches Lernen deaktivieren (RestrictImplicitTextCollection)" +737,"Administrative Templates: Control Panel","Screen saver timeout",DE,"Administrative Vorlagen: Systemsteuerung","Zeitlimit für Bildschirmschoner" +532,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy",,, +785,"Administrative Templates: LAPS","Do not allow password expiration time longer than required by policy (Member)",,, +533,"Administrative Templates: LAPS","Enable local admin password management",,, +786,"Administrative Templates: LAPS","Enable local admin password management (Member)",,, +531,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE",,, +784,"Administrative Templates: LAPS","LAPS AdmPwd GPO Extension / CSE (Member)",,, +536,"Administrative Templates: LAPS","Password Settings: Password Age (Days)",,, +789,"Administrative Templates: LAPS","Password Settings: Password Age (Days) (Member)",,, +534,"Administrative Templates: LAPS","Password Settings: Password Complexity",,, +787,"Administrative Templates: LAPS","Password Settings: Password Complexity (Member)",,, +535,"Administrative Templates: LAPS","Password Settings: Password Length",,, +788,"Administrative Templates: LAPS","Password Settings: Password Length (Member)",,, +1666,"Administrative Templates: Network","DNS Client: Configure DNS over HTTPS (DoH) name resolution",,, +1697,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",,, +1887,"Administrative Templates: Network","DNS Client: Configure multicast DNS (mDNS) protocol",,, +1888,"Administrative Templates: Network","DNS Client: Turn off default IPv6 DNS Servers",,, +99,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",DE,"Administrative Vorlagen: Netzwerk","DNS-Client: Multicastnamensauflösung deaktivieren (LLMNR)" +568,"Administrative Templates: Network","Disable IPv6",,, +553,"Administrative Templates: Network","Fonts: Enable Font Providers",DE,"Administrative Vorlagen: Netzwerk","Schriftarten: Schriftartenanbieter aktivieren" +1829,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",,, +1830,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",,, +1831,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",,, +1832,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",,, +1833,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",,, +1834,"Administrative Templates: Network","Lanman Server: Mandate the maximum version of SMB",,, +1835,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",,, +1836,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",,, +1837,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",,, +1838,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",,, +1839,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",,, +100,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",DE,"Administrative Vorlagen: Netzwerk","LanMan-Arbeitsstation: Unsichere Gastanmeldungen aktivieren" +1840,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",,, +1841,"Administrative Templates: Network","Lanman Workstation: Mandate the maximum version of SMB",,, +1842,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",,, +1843,"Administrative Templates: Network","Lanman Workstation: Require Encryption",,, +556,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOnPublicNet)",DE,"Administrative Vorlagen: Netzwerk","Verbindungsschicht-Topologieerkennung: Treiber für die Zuordnungs-E/A (LLTDIO) aktivieren (AllowLLTDIOOnPublicNet)" +555,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (AllowLLTDIOOndomain)",DE,"Administrative Vorlagen: Netzwerk","Verbindungsschicht-Topologieerkennung: Treiber für die Zuordnungs-E/A (LLTDIO) aktivieren (AllowLLTDIOOndomain)" +557,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (EnableLLTDIO)",DE,"Administrative Vorlagen: Netzwerk","Verbindungsschicht-Topologieerkennung: Treiber für die Zuordnungs-E/A (LLTDIO) aktivieren (EnableLLTDIO)" +558,"Administrative Templates: Network","Link-Layer Topology Discovery: Turn on Mapper I/O (LLTDIO) driver (ProhibitLLTDIOOnPrivateNet)",DE,"Administrative Vorlagen: Netzwerk","Verbindungsschicht-Topologieerkennung: Treiber für die Zuordnungs-E/A (LLTDIO) aktivieren (ProhibitLLTDIOOnPrivateNet)" +563,"Administrative Templates: Network","Network Connections: Prohibit installation and configuration of Network Bridge on your DNS domain network",DE,"Administrative Vorlagen: Netzwerk","Netzwerkverbindungen: Installation und Konfiguration der Netzwerkbridge im eigenen DNS-Domänennetzwerk nicht zulassen" +564,"Administrative Templates: Network","Network Connections: Prohibit use of Internet Connection Sharing on your DNS domain network",DE,"Administrative Vorlagen: Netzwerk","Netzwerkverbindungen: Verwendung der gemeinsam genutzten Internetverbindung im eigenen DNS-Domänennetzwerk nicht zulassen" +565,"Administrative Templates: Network","Network Connections: Require domain users to elevate when setting a network's location",DE,"Administrative Vorlagen: Netzwerk","Netzwerkverbindungen: Höhere Rechte von Domänenbenutzern beim Festlegen einer Netzwerkadresse anfordern" +566,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (NETLOGON)",DE,"Administrative Vorlagen: Netzwerk","Netzwerkanbieter: Gehärtete UNC-Pfade (NETLOGON)" +567,"Administrative Templates: Network","Network Provider: Hardened UNC Paths (SYSVOL)",DE,"Administrative Vorlagen: Netzwerk","Netzwerkanbieter: Gehärtete UNC-Pfade (SYSVOL)" +1328,"Administrative Templates: Network","SSL Configuration Settings: ECC Curve Order",,, +1602,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order",,, +1907,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (NULL bulk encryption)",,, +1906,"Administrative Templates: Network","SSL Configuration Settings: SSL Cipher Suite Order (RSA key transport)",,, +101,"Administrative Templates: Network","Turn off Microsoft Peer-to-Peer Networking Services",DE,"Administrative Vorlagen: Netzwerk","Microsoft Peer-zu-Peer-Netzwerkdienste deaktivieren" +559,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnDomain)",DE,"Administrative Vorlagen: Netzwerk","Treiber für den Beantworter (RSPNDR) aktivieren (AllowRspndrOnDomain)" +560,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (AllowRspndrOnPublicNet)",DE,"Administrative Vorlagen: Netzwerk","Treiber für den Beantworter (RSPNDR) aktivieren (AllowRspndrOnPublicNet)" +561,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (EnableRspndr)",DE,"Administrative Vorlagen: Netzwerk","Treiber für den Beantworter (RSPNDR) aktivieren (EnableRspndr)" +562,"Administrative Templates: Network","Turn on Responder (RSPNDR) driver (ProhibitRspndrOnPrivateNet)",DE,"Administrative Vorlagen: Netzwerk","Treiber für den Beantworter (RSPNDR) aktivieren (ProhibitRspndrOnPrivateNet)" +102,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",DE,"Administrative Vorlagen: Netzwerk","WLAN-Einstellungen: Zulassen, dass Windows automatisch eine Verbindung mit vorgeschlagenen öffentlichen Hotspots, von Kontakten freigegebenen Netzwerken und kostenpflichtigen Hotspots herstellt" +572,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableFlashConfigRegistrar)",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Konfiguration von Drahtloseinstellungen mit Windows-Sofortverbindung (DisableFlashConfigRegistrar)" +571,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableInBand802DOT11Registrar)",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Konfiguration von Drahtloseinstellungen mit Windows-Sofortverbindung (DisableInBand802DOT11Registrar)" +570,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableUPnPRegistrar)",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Konfiguration von Drahtloseinstellungen mit Windows-Sofortverbindung (DisableUPnPRegistrar)" +573,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (DisableWPDRegistrar)",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Konfiguration von Drahtloseinstellungen mit Windows-Sofortverbindung (DisableWPDRegistrar)" +569,"Administrative Templates: Network","Windows Connect Now: Configuration of wireless settings using Windows Connect Now (EnableRegistrars)",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Konfiguration von Drahtloseinstellungen mit Windows-Sofortverbindung (EnableRegistrars)" +574,"Administrative Templates: Network","Windows Connect Now: Prohibit access of the Windows Connect Now wizards",DE,"Administrative Vorlagen: Netzwerk","Windows-Sofortverbindung: Zugriff auf Windows-Sofortverbindungs-Assistenten verweigern" +575,"Administrative Templates: Network","Windows Connection Manager: Minimize the number of simultaneous connections to the Internet or a Windows Domain",DE,"Administrative Vorlagen: Netzwerk","Windows-Verbindungs-Manager: Anzahl gleichzeitiger Verbindungen mit dem Internet oder einer Windows-Domäne minimieren" +576,"Administrative Templates: Network","Windows Connection Manager: Prohibit connection to non-domain networks when connected to domain authenticated network",DE,"Administrative Vorlagen: Netzwerk","Windows-Verbindungs-Manager: Verbindung mit Nicht-Domänennetzwerken bei vorhandener Verbindung mit domänenauthentifiziertem Netzwerk nicht zulassen" +1751,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",,, +1759,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",,, +1764,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",,, +1765,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",,, +1752,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",,, +1760,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",,, +1748,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",,, +1756,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",,, +1749,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",,, +1757,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",,, +1750,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",,, +1758,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",,, +1753,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",,, +1761,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",,, +1754,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",,, +1762,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",,, +1755,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",,, +1763,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",,, +1667,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",,, +1700,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",,, +1699,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",,, +1702,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",,, +1701,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",,, +1703,"Administrative Templates: Printers","Configure RPC over TCP port",,, +1844,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",,, +1698,"Administrative Templates: Printers","Configure Redirection Guard",,, +1930,"Administrative Templates: Printers","Configure Windows Ready Print driver ranking",,, +1889,"Administrative Templates: Printers","Configure Windows protected print",,, +1704,"Administrative Templates: Printers","Limits print driver installation to Administrators",,, +1705,"Administrative Templates: Printers","Manage processing of Queue-specific files",,, +1650,"Administrative Templates: Printers","Only use Package Point and Print (CVE-2021-36958)",,, +1651,"Administrative Templates: Printers","Package Point and Print - Approved servers (CVE-2021-36958)",,, +1645,"Administrative Templates: Printers","Point and Print Restrictions: Only administrators can install printer drivers on a print server (CVE-2021-34527)",,, +1668,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection",,, +1643,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527)",,, +1669,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection",,, +1644,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527)",,, +1931,"Administrative Templates: Printers","Require IPPS for IPP printers",,, +1932,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority",,, +1934,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name",,, +1935,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow invalid certificate date",,, +1933,"Administrative Templates: Printers","Set TLS/SSL security policy for IPP printers: Disallow non-server certificates",,, +298,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",,, +577,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",DE,"Administrative Vorlagen: Startmenü und Taskleiste","Benachrichtigungen: Netzwerkverwendung für Benachrichtigungen deaktivieren" +299,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",DE,"Administrative Vorlagen: Startmenü und Taskleiste","Benachrichtigungen: Popupbenachrichtigungen auf gesperrtem Bildschirm deaktivieren" +1805,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",,, +578,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",,, +1845,"Administrative Templates: System","Configure the behavior of the sudo command",,, +103,"Administrative Templates: System","Credentials Delegation: Allow delegation default credentials",,, +104,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",DE,"Administrative Vorlagen: System","Delegierung von Anmeldeinformationen: Encryption Oracle-Abwehr" +819,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",DE,"Administrative Vorlagen: System","Delegierung von Anmeldeinformationen: Remotehost ermöglicht die Delegierung nicht exportierbarer Anmeldeinformationen" +114,"Administrative Templates: System","Device Guard: Available Security Properties: DMA protection",,, +113,"Administrative Templates: System","Device Guard: Available Security Properties: Secure Boot",,, +793,"Administrative Templates: System","Device Guard: Credential Guard Configuration (DC)",,, +792,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Member)",,, +582,"Administrative Templates: System","Device Guard: Credential Guard Configuration (Policy)",,, +1706,"Administrative Templates: System","Device Guard: Kernel-mode Hardware-enforced Stack Protection (Policy)",,, +119,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",,, +120,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",,, +115,"Administrative Templates: System","Device Guard: Security Services Configured: Credential Guard",,, +116,"Administrative Templates: System","Device Guard: Security Services Configured: HVCI",,, +117,"Administrative Templates: System","Device Guard: Security Services Running: Credential Guard",,, +118,"Administrative Templates: System","Device Guard: Security Services Running: HVCI",,, +580,"Administrative Templates: System","Device Guard: Select Platform Security Level (Policy)",,, +1307,"Administrative Templates: System","Device Guard: Support for Virtualization Based Security (Microsoft-Hyper-V-Hypervisor)",,, +579,"Administrative Templates: System","Device Guard: Turn On Virtualization Based Security (Policy)",,, +581,"Administrative Templates: System","Device Guard: Virtualization Based Protection of Code Integrity (Policy)",,, +112,"Administrative Templates: System","Device Guard: Virtualization Based Security Status",,, +121,"Administrative Templates: System","Device Guard: Windows Defender Application Control deployed (Policy)",,, +107,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire)",,, +108,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit diesen Geräte-IDs verhindern PCI\CC_0C0A (Thunderbolt)" +105,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit diesen Geräte-IDs verhindern" +106,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit diesen Geräte-IDs verhindern (Retroactive)" +586,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen 6bdd1fc1-810f-11d0-bec7-08002be2092f (SBP-2 drive)" +584,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen 7ebefbc0-3200-11d2-b4c2-00a0C9697d07 (SBP-2 drive)" +109,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen" +110,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen (Retroactive)" +585,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen c06ff265-ae09-48f0-812c-16753d7cba83 (SBP-2 drive)" +111,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",DE,"Administrative Vorlagen: System","Geräteinstallation: Einschränkungen bei der Geräteinstallation: Installation von Geräten mit Treibern verhindern, die diesen Gerätesetupklassen entsprechen d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)" +1684,"Administrative Templates: System","Device Installation: Prevent automatic download of applications associated with device metadata",,, +122,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",DE,"Administrative Vorlagen: System","Antischadsoftware-Frühstart: Richtlinie für Bootstarttreiber-Initialisierung" +1936,"Administrative Templates: System","Filesystem: Enable / disable CLFS logfile authentication",,, +1802,"Administrative Templates: System","Group Policy: Configure security policy processing: Do not apply during periodic background processing",,, +1688,"Administrative Templates: System","Group Policy: Configure security policy processing: Process even if the Group Policy objects have not changed",,, +587,"Administrative Templates: System","Group Policy: Continue experiences on this device",DE,"Administrative Vorlagen: System","Gruppenrichtlinie: Auf der Oberfläche dieses Geräts weiterverarbeiten" +124,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",DE,"Administrative Vorlagen: System","Gruppenrichtlinie: Während regelmäßiger Hintergrundverarbeitung nicht übernehmen" +123,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",DE,"Administrative Vorlagen: System","Gruppenrichtlinie: Gruppenrichtlinienobjekte auch ohne Änderungen verarbeiten" +588,"Administrative Templates: System","Group Policy: Turn off background refresh of Group Policy",DE,"Administrative Vorlagen: System","Gruppenrichtlinie: Hintergrundaktualisierung der Gruppenrichtlinie deaktivieren" +300,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Programm zur Verbesserung der Hilfebenutzerfreundlichkeit deaktivieren" +592,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Verbindungs-Assistenten deaktivieren, wenn sich die URL-Verbindung auf microsoft.com bezieht" +129,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Internet-Download für die Assistenten ""Webpublishing"" und ""Onlinebestellung von Abzügen"" deaktivieren" +594,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Registration if URL connection is referring to Microsoft.com",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Registrierung deaktivieren, wenn sich die URL-Verbindung auf ""Microsoft.com"" bezieht" +595,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Search Companion content file updates",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Inhaltdateiupdates des Such-Assistenten deaktivieren" +130,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Programm zur Verbesserung der Benutzerfreundlichkeit deaktivieren" +127,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Fehlerberichterstattung deaktivieren 1" +128,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Fehlerberichterstattung deaktivieren 2" +589,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off access to the Store",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Zugriff auf den Store deaktivieren" +126,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Download von Druckertreibern über HTTP deaktivieren" +590,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting personalization data sharing",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Freigabe von Daten für die Handschriftanpassung deaktivieren" +591,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off handwriting recognition error reporting",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Handschrifterkennungs-Fehlerberichterstattung deaktivieren" +593,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off printing over HTTP",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Drucken über HTTP deaktivieren" +596,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Order Prints' picture task",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Aufgabe ""Abzüge online bestellen"" für Bilder deaktivieren" +597,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the 'Publish to Web' task for files and folders",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Aufgabe ""Im Web veröffentlichen"" für Dateien und Ordner deaktivieren" +125,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",DE,"Administrative Vorlagen: System","Internetkommunikationsverwaltung: Internetkommunikationseinstellungen: Programm zur Verbesserung der Benutzerfreundlichkeit deaktivieren" +1846,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon",,, +1847,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-1)",,, +1848,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-256)",,, +1849,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-384)",,, +1850,"Administrative Templates: System","KDC: Configure hash algorithms for certificate logon (SHA-512)",,, +1851,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon",,, +1852,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-1)",,, +1853,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-256)",,, +1854,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-384)",,, +1855,"Administrative Templates: System","Kerberos: Configure hash algorithms for certificate logon (SHA-512)",,, +598,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitBehavior)",DE,"Administrative Vorlagen: System","Kerberos: Geräteauthentifizierung mittels Zertifikat unterstützen (DevicePKInitBehavior)" +599,"Administrative Templates: System","Kerberos: Support device authentication using certificate (DevicePKInitEnabled)",DE,"Administrative Vorlagen: System","Kerberos: Geräteauthentifizierung mittels Zertifikat unterstützen (DevicePKInitEnabled)" +131,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",DE,"Administrative Vorlagen: System","Kernel-DMA-Schutz: Aufzählungsrichtlinie für externe Geräte, die nicht Kernel-DMA-Schutz kompatibel sind" +1785,"Administrative Templates: System","LAPS: Configure password backup directory",,, +1806,"Administrative Templates: System","LAPS: Do not allow password expiration time longer than required by policy",,, +1786,"Administrative Templates: System","LAPS: Enable password backup for DSRM accounts",,, +1787,"Administrative Templates: System","LAPS: Enable password encryption",,, +1809,"Administrative Templates: System","LAPS: Password Settings: Password Age (Days)",,, +1807,"Administrative Templates: System","LAPS: Password Settings: Password Complexity",,, +1808,"Administrative Templates: System","LAPS: Password Settings: Password Length",,, +1811,"Administrative Templates: System","LAPS: Post-authentication actions: Actions",,, +1810,"Administrative Templates: System","LAPS: Post-authentication actions: Grace period (hours)",,, +1707,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",,, +1708,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",,, +600,"Administrative Templates: System","Locale Services: Disallow copying of user input methods to the system account for sign-in",DE,"Administrative Vorlagen: System","Gebietsschemadienste: Kopieren von Benutzereingabemethoden ins Systemkonto für die Anmeldung nicht zulassen" +1777,"Administrative Templates: System","Logon: Always use classic logon",,, +601,"Administrative Templates: System","Logon: Block user from showing account details on sign-in",DE,"Administrative Vorlagen: System","Anmelden: Benutzer darf keine Kontodetails auf dem Anmeldebildschirm anzeigen" +134,"Administrative Templates: System","Logon: Do not display network selection UI",DE,"Administrative Vorlagen: System","Anmelden: Netzwerkauswahl-UI nicht anzeigen" +603,"Administrative Templates: System","Logon: Do not enumerate connected users on domain-joined computers",DE,"Administrative Vorlagen: System","Anmelden: Verbundene Benutzer auf Computern, die der Domäne angehören, nicht auflisten" +604,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers",DE,"Administrative Vorlagen: System","Anmelden: Lokale Benutzer auf Computern, die der Domäne angehören, auflisten" +794,"Administrative Templates: System","Logon: Enumerate local users on domain-joined computers (Member)",,, +133,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",DE,"Administrative Vorlagen: System","Anmelden: Anwendungsbenachrichtigungen auf gesperrtem Bildschirm deaktivieren" +605,"Administrative Templates: System","Logon: Turn off picture password sign-in",DE,"Administrative Vorlagen: System","Anmelden: Anmeldung mit Bildcode deaktivieren" +132,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",DE,"Administrative Vorlagen: System","Anmelden: Komfortable PIN-Anmeldung aktivieren" +135,"Administrative Templates: System","Mitigation Options: Untrusted Font Blocking",,, +1890,"Administrative Templates: System","Net Logon: DC Locator DNS Records: Block NetBIOS-based discovery for domain controller location",,, +136,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",DE,"Administrative Vorlagen: System","Betriebssystemrichtlinien: Synchronisierung der Zwischenablage geräteübergreifend zulassen" +606,"Administrative Templates: System","OS Policies: Allow upload of User Activities",DE,"Administrative Vorlagen: System","Betriebssystemrichtlinien: Upload von Benutzeraktivitäten zulassen" +1329,"Administrative Templates: System","PIN Complexity: Minimum PIN length",,, +141,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",DE,"Administrative Vorlagen: System","Remoteprozeduraufruf: Remoteunterstützung anbieten" +142,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",DE,"Administrative Vorlagen: System","Remoteprozeduraufruf: Angeforderte Remoteunterstützung" +821,"Administrative Templates: System","Remote Assistance: Maximum ticket time (units)",,, +820,"Administrative Templates: System","Remote Assistance: Maximum ticket time (value)",,, +822,"Administrative Templates: System","Remote Assistance: Method for sending email invitations",,, +823,"Administrative Templates: System","Remote Assistance: Permit remote control of this computer",,, +143,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",DE,"Administrative Vorlagen: System","Remoteprozeduraufruf: RPC-Endpunktzuordnungs-Clientauthentifizierung aktivieren" +795,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication (Member)",,, +144,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",DE,"Administrative Vorlagen: System","Remoteprozeduraufruf: Nicht authentifizierte RPC-Clients einschränken" +796,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients (Member)",,, +1891,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy",,, +1908,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (DC)",,, +1909,"Administrative Templates: System","Security Account Manager: Configure SAM change password RPC methods policy (Member)",,, +1685,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication",,, +1686,"Administrative Templates: System","Security Account Manager: Configure validation of ROCA-vulnerable WHfB keys during authentication (DC only)",,, +145,"Administrative Templates: System","Security Settings: Enable svchost.exe mitigation options",,, +607,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (on battery)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Netzwerkverbindungen im verbundenen Standbymodus zulassen (Akkubetrieb)" +608,"Administrative Templates: System","Sleep Settings: Allow network connectivity during connected-standby (plugged in)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Netzwerkverbindungen im verbundenen Standbymodus zulassen (Netzbetrieb)" +140,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Standbyzustände (S1-S3) zulassen (Akkubetrieb)" +139,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Standbyzustände (S1-S3) zulassen (Netzbetrieb)" +138,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Kennwort anfordern, wenn ein Computer reaktiviert wird (Akkubetrieb)" +137,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",DE,"Administrative Vorlagen: System","Standbymoduseinstellungen: Kennwort anfordern, wenn ein Computer reaktiviert wird (Netzbetrieb)" +148,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",DE,"Administrative Vorlagen: System","Zeitanbieter: Windows-NTP-Client aktivieren" +149,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",DE,"Administrative Vorlagen: System","Zeitanbieter: Windows-NTP-Server aktivieren" +797,"Administrative Templates: System","Time Providers: Enable Windows NTP Server (Member)",,, +609,"Administrative Templates: System","Troubleshooting and Diagnostics: Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider",DE,"Administrative Vorlagen: System","Problembehandlung und Diagnose: Microsoft Support-Diagnosetool: interaktive MSDT-Kommunikation mit Unterstützungsanbieter aktivieren" +1548,"Administrative Templates: System","Trusted Platform Module Services: Ignore the default list of blocked TPM commands",DE,"Administrative Vorlagen: System","Trusted Platform Module-Dienste: Standardliste der blockierten TPM-Befehle ignorieren" +1549,"Administrative Templates: System","Trusted Platform Module Services: Standard User Lockout Duration",DE,"Administrative Vorlagen: System","Trusted Platform Module-Dienste: Standardbenutzer-Sperrdauer" +1550,"Administrative Templates: System","Trusted Platform Module Services: Standard User Total Lockout Threshold",DE,"Administrative Vorlagen: System","Trusted Platform Module-Dienste: Standardbenutzer-Sperrschwelle (gesamt)" +147,"Administrative Templates: System","User Profiles: Turn off the advertising ID",DE,"Administrative Vorlagen: System","Benutzerprofile: Werbe-ID deaktivieren" +146,"Administrative Templates: System","Windows Performance PerfTrack: Enable/Disable PerfTrack",DE,"Administrative Vorlagen: System","Windows-Leistungsnachverfolgungsmodul: PerfTrack aktivieren/deaktivieren" +150,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",DE,"Administrative Vorlagen: Windows-Komponenten","Bereitstellung von App-Paketen: Windows-Apps die Freigabe von Anwendungsdaten zwischen Benutzern erlauben" +1895,"Administrative Templates: Windows Components","App Package Deployment: Not allow per-user unsigned packages to install by default (requires explicitly allow per install)",,, +610,"Administrative Templates: Windows Components","App Package Deployment: Prevent non-admin users from installing packaged Windows apps",,, +151,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",,, +1892,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",,, +1893,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",,, +1894,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",,, +722,"Administrative Templates: Windows Components","App and browser protection: Prevent users from modifying settings",DE,"Administrative Vorlagen: Windows-Komponenten","App- und Browserschutz: Benutzer am Ändern von Einstellungen hindern" +611,"Administrative Templates: Windows Components","App runtime: Allow Microsoft accounts to be optional",DE,"Administrative Vorlagen: Windows-Komponenten","App-Laufzeit: Zulassen, dass Microsoft-Konten optional sind" +152,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",DE,"Administrative Vorlagen: Windows-Komponenten","App-Laufzeit: Starten von universellen Windows-Apps mit Windows-Runtime-API-Zugriff von gehosteten Inhalten aus blockieren" +153,"Administrative Templates: Windows Components","Application Compatibility: Turn off Application Telemetry",,, +962,"Administrative Templates: Windows Components","Application Compatibility: Turn off Inventory Collector",,, +738,"Administrative Templates: Windows Components","Attachment Manager: Do not preserve zone information in file attachments",DE,"Administrative Vorlagen: Windows-Komponenten","Anlagen-Manager: Zoneninformationen in Dateianlagen nicht beibehalten" +739,"Administrative Templates: Windows Components","Attachment Manager: Notify antivirus programs when opening attachments",DE,"Administrative Vorlagen: Windows-Komponenten","Anlagen-Manager: Antivirenprogramme beim Öffnen von Anlagen benachrichtigen" +155,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",DE,"Administrative Vorlagen: Windows-Komponenten","Richtlinien für die automatische Wiedergabe: Automatische Wiedergabe für andere Geräte als Volumes nicht zulassen" +156,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",DE,"Administrative Vorlagen: Windows-Komponenten","Richtlinien für die automatische Wiedergabe: Standardverhalten von AutoAusführen festlegen" +154,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",DE,"Administrative Vorlagen: Windows-Komponenten","Richtlinien für die automatische Wiedergabe: Autoplay deaktivieren" +157,"Administrative Templates: Windows Components","Biometrics: Allow the use of biometrics",,, +612,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",DE,"Administrative Vorlagen: Windows-Komponenten","Biometrie: Gesichtserkennung: Erweitertes Antispoofing konfigurieren" +1318,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for fixed data drives)",,, +1317,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)",,, +1319,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for removable data drives)",,, +159,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",,, +1538,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Drive encryption method (for operating system drives)",,, +613,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows",,, +614,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered",,, +615,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent",,, +620,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS",,, +621,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives",,, +618,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard",,, +617,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Key",,, +616,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Recovery Password",,, +619,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives",,, +622,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives",,, +625,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict crypto algorithms or cipher suites",,, +624,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",,, +623,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of hardware-based encryption for fixed data drives: Use BitLocker software-based encryption when hardware encryption is not available",,, +626,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of passwords for fixed data drives",,, +627,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives",,, +628,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Fixed Data Drives: Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives",,, +160,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",,, +162,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",,, +629,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered",,, +630,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent",,, +635,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS",,, +636,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives",,, +633,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard",,, +632,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Key",,, +631,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Recovery Password",,, +634,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives",,, +1330,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup",,, +163,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",,, +638,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict crypto algorithms or cipher suites",,, +637,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",,, +639,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of passwords for operating system drives",,, +161,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",,, +165,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",,, +166,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",,, +167,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",,, +168,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",,, +169,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",,, +164,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Use BitLocker software-based encryption when hardware encryption is not available",,, +640,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Allow access to BitLocker-protected removable data drives from earlier versions of Windows",,, +641,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered",,, +642,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent",,, +648,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives",,, +647,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS",,, +645,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Omit recovery options from the BitLocker setup wizard",,, +644,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Key",,, +643,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Recovery Password",,, +646,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Choose how BitLocker-protected removable drives can be recovered: Save BitLocker recovery information to AD DS for removable data drives",,, +649,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives",,, +652,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict crypto algorithms or cipher suites",,, +651,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Restrict encryption algorithms and cipher suites allowed for hardware-based encryption",,, +650,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of hardware-based encryption for removable data drives: Use BitLocker software-based encryption when hardware encryption is not available",,, +653,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of passwords for removable data drives",,, +654,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives",,, +655,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Configure use of smart cards on removable data drives: Require use of smart cards on removable data drives",,, +656,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker",,, +657,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Removable Data Drives: Do not allow write access to devices configured in another organization",,, +158,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Volume status",,, +658,"Administrative Templates: Windows Components","Camera: Allow Use of Camera",DE,"Administrative Vorlagen: Windows-Komponenten","Kamera: Kameraverwendung zulassen" +740,"Administrative Templates: Windows Components","Cloud Content: Configure Windows spotlight on lock screen",DE,"Administrative Vorlagen: Windows-Komponenten","Cloudinhalt: Windows-Blickpunkt auf Sperrbildschirm konfigurieren" +170,"Administrative Templates: Windows Components","Cloud Content: Do not show Windows tips",,, +302,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",DE,"Administrative Vorlagen: Windows-Komponenten","Cloudinhalt: Keine Inhalte von Drittanbietern in Windows-Blickpunkt vorschlagen" +301,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",DE,"Administrative Vorlagen: Windows-Komponenten","Cloudinhalt: Keine Diagnosedaten zur Personalisierung der Benutzererfahrung verwenden" +171,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",DE,"Administrative Vorlagen: Windows-Komponenten","Cloudinhalt: Microsoft-Anwenderfeatures deaktivieren" +1663,"Administrative Templates: Windows Components","Cloud Content: Turn off Spotlight collection on Desktop",,, +741,"Administrative Templates: Windows Components","Cloud Content: Turn off all Windows spotlight features",DE,"Administrative Vorlagen: Windows-Komponenten","Cloudinhalt: Features von Windows-Blickpunkt deaktivieren" +1670,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",,, +1313,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud optimized content",,, +659,"Administrative Templates: Windows Components","Connect: Require pin for pairing",DE,"Administrative Vorlagen: Windows-Komponenten","Verbinden: PIN für die Kopplung anfordern" +172,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",DE,"Administrative Vorlagen: Windows-Komponenten","Benutzerschnittstelle für Anmeldeinformationen: Schaltfläche zum Anzeigen von Kennwörtern nicht anzeigen" +174,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",DE,"Administrative Vorlagen: Windows-Komponenten","Benutzerschnittstelle für Anmeldeinformationen: Bei Ausführung mit erhöhten Rechten Administratorkonten auflisten" +660,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",,, +173,"Administrative Templates: Windows Components","Credential User Interface: Require trusted path for credential entry",,, +175,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",DE,"Administrative Vorlagen: Windows-Komponenten","Datensammlung und Vorabversionen: Telemetrie zulassen" +176,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",DE,"Administrative Vorlagen: Windows-Komponenten","Datensammlung und Vorabversionen: Übermitteln des Gerätenamens in Windows-Diagnosedaten zulassen" +661,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service",DE,"Administrative Vorlagen: Windows-Komponenten","Datensammlung und Vorabversionen: Verwendung des authentifizierenden Proxys für den Dienst ""Benutzererfahrung und Telemetrie im verbundenen Modus" +1671,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",,, +662,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",DE,"Administrative Vorlagen: Windows-Komponenten","Datensammlung und Vorabversionen: Feedbackbenachrichtigungen nicht mehr anzeigen" +1672,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Enable OneSettings Auditing",,, +1673,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",,, +1674,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",,, +964,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Enhanced diagnostic data to the minimum required by Windows Analytics",,, +663,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Toggle user control over Insider builds",DE,"Administrative Vorlagen: Windows-Komponenten","Datensammlung und Vorabversionen: Benutzersteuerung für Insider-Builds ein-/ausschalten Hinweis: Diese Gruppenrichtlinie ist nur auf Windows 10 Versionen bis einschließlich der Version 1703 anwendbar. Für Versionen ab 1709 wird die Gruppenrichtlinie ""Vorabversionen verwalten"" verwendet (siehe CIS Benchmark Referenz 18.9.102.1.1)." +177,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",DE,"Administrative Vorlagen: Windows-Komponenten","Übermittlungsoptimierung: Downloadmodus" +1766,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer",,, +1767,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Experimental Features",,, +1768,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Hash Override",,, +1896,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Local Archive Malware Scan Override",,, +1897,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer Microsoft Store Source Certificate Validation Bypass",,, +1769,"Administrative Templates: Windows Components","Desktop App Installer: Enable App Installer ms-appinstaller protocol",,, +1898,"Administrative Templates: Windows Components","Desktop App Installer: Enable Windows Package Manager command line interfaces",,, +1626,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (AntiDetours)",,, +1627,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (BannedFunctions)",,, +1628,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (DeepHooks)",,, +1629,"Administrative Templates: Windows Components","EMET: Default Action and Mitigation Settings (ExploitAction)",,, +1630,"Administrative Templates: Windows Components","EMET: Default Protections for Internet Explorer",,, +1631,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Popular Software)",,, +1632,"Administrative Templates: Windows Components","EMET: Default Protections for Popular Software (Recommended Software)",,, +1633,"Administrative Templates: Windows Components","EMET: System ASLR",,, +1634,"Administrative Templates: Windows Components","EMET: System DEP",,, +1635,"Administrative Templates: Windows Components","EMET: System SEHOP",,, +664,"Administrative Templates: Windows Components","Event Log Service: Application: Control Event Log behavior when the log file reaches its maximum size",,, +178,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",,, +1738,"Administrative Templates: Windows Components","Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB)",,, +1747,"Administrative Templates: Windows Components","Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB)",,, +665,"Administrative Templates: Windows Components","Event Log Service: Security: Control Event Log behavior when the log file reaches its maximum size",,, +179,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",,, +666,"Administrative Templates: Windows Components","Event Log Service: Setup: Control Event Log behavior when the log file reaches its maximum size",,, +668,"Administrative Templates: Windows Components","Event Log Service: Setup: Specify the maximum log file size (KB)",,, +667,"Administrative Templates: Windows Components","Event Log Service: System: Control Event Log behavior when the log file reaches its maximum size",,, +180,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",,, +181,"Administrative Templates: Windows Components","File Explorer: Allow the use of remote paths in file shortcut icons",,, +263,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen",DE,"Administrative Vorlagen: Windows-Komponenten","Explorer: Windows Defender SmartScreen konfigurieren" +264,"Administrative Templates: Windows Components","File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",DE,"Administrative Vorlagen: Windows-Komponenten","Explorer: Umgehen der Windows Defender SmartScreen-Aufforderungen für Websites verhindern" +1856,"Administrative Templates: Windows Components","File Explorer: Do not apply the Mark of the Web tag to files copied from insecure sources",,, +1535,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn off Preview Pane",,, +1536,"Administrative Templates: Windows Components","File Explorer: Explorer Frame Pane: Turn on or off details pane",,, +669,"Administrative Templates: Windows Components","File Explorer: Turn off Data Execution Prevention for Explorer",DE,"Administrative Vorlagen: Windows-Komponenten","Datei-Explorer: Datenausführungsverhinderung für Explorer deaktivieren" +1774,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",,, +670,"Administrative Templates: Windows Components","File Explorer: Turn off heap termination on corruption",DE,"Administrative Vorlagen: Windows-Komponenten","Datei-Explorer: Heapabbruch bei Beschädigung deaktivieren" +671,"Administrative Templates: Windows Components","File Explorer: Turn off shell protocol protected mode",DE,"Administrative Vorlagen: Windows-Komponenten","Datei-Explorer: Geschützten Modus für Shellprotokoll deaktivieren" +182,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",,, +1913,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",,, +1770,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 as a standalone browser",,, +835,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Allow software to run or install even if the signature is invalid",,, +836,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for server certificate revocation",,, +837,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Check for signatures on downloaded programs",,, +838,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled",,, +839,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn off encryption support",,, +840,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows",,, +841,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Advanced Page: Turn on Enhanced Protected Mode",,, +834,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Prevent ignoring certificate errors",,, +844,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Access data sources across domains",,, +854,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow VBScript to run in Internet Explorer",,, +845,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow cut, copy or paste operations from the clipboard via script",,, +846,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow drag and drop or copy and paste files",,, +847,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow loading of XAML files",,, +848,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use ActiveX controls without prompt",,, +849,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow only approved domains to use the TDC ActiveX control",,, +851,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow script-initiated windows without size or position constraints",,, +850,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scripting of Internet Explorer WebBrowser controls",,, +852,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow scriptlets",,, +853,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Allow updates to status bar via script",,, +855,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Automatic prompting for file downloads",,, +856,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Don't run antimalware programs against ActiveX controls",,, +857,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download signed ActiveX controls",,, +858,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Download unsigned ActiveX controls",,, +859,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains across windows",,, +860,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Enable dragging of content from different domains within a window",,, +861,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Include local path when user is uploading files to a server",,, +862,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Initialize and script ActiveX controls not marked as safe",,, +863,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Java permissions",,, +864,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Launching applications and files in an IFRAME",,, +865,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Logon options",,, +866,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Navigate windows and frames across different domains",,, +867,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components not signed with Authenticode",,, +868,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Run .NET Framework-reliant components signed with Authenticode",,, +869,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Show security warning for potentially unsafe files",,, +870,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Cross-Site Scripting Filter",,, +871,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on Protected Mode",,, +872,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Turn on SmartScreen Filter scan",,, +873,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Use Pop-up Blocker",,, +874,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Userdata persistence",,, +875,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Internet Zone: Web sites in less privileged Web content zones can navigate into this zone",,, +842,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Sites: Include all network paths (UNCs)",,, +876,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Don't run antimalware programs against ActiveX controls",,, +877,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Initialize and script ActiveX controls not marked as safe",,, +878,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Intranet Zone: Java permissions",,, +879,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Don't run antimalware programs against ActiveX controls",,, +880,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Local Machine Zone: Java permissions",,, +881,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Internet Zone: Turn on SmartScreen Filter scan",,, +882,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Intranet Zone: Java permissions",,, +883,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Local Machine Zone: Java permissions",,, +884,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Java permissions",,, +885,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Restricted Sites Zone: Turn on SmartScreen Filter scan",,, +886,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Locked-Down Trusted Sites Zone: Java permissions",,, +887,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Access data sources across domains",,, +894,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow META REFRESH",,, +901,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow VBScript to run in Internet Explorer",,, +888,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow active scripting",,, +889,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow binary and script behaviors",,, +890,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow cut, copy or paste operations from the clipboard via script",,, +891,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow drag and drop or copy and paste files",,, +892,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow file downloads",,, +893,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow loading of XAML files",,, +895,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use ActiveX controls without prompt",,, +896,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow only approved domains to use the TDC ActiveX control",,, +898,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow script-initiated windows without size or position constraints",,, +897,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scripting of Internet Explorer WebBrowser controls",,, +899,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow scriptlets",,, +900,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Allow updates to status bar via script",,, +902,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Automatic prompting for file downloads",,, +903,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Don't run antimalware programs against ActiveX controls",,, +904,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download signed ActiveX controls",,, +905,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Download unsigned ActiveX controls",,, +906,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains across windows",,, +907,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Enable dragging of content from different domains within a window",,, +908,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Include local path when user is uploading files to a server",,, +909,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Initialize and script ActiveX controls not marked as safe",,, +910,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Java permissions",,, +911,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Launching applications and files in an IFRAME",,, +912,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Logon options",,, +913,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Navigate windows and frames across different domains",,, +914,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components not signed with Authenticode",,, +915,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run .NET Framework-reliant components signed with Authenticode",,, +916,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Run ActiveX controls and plugins",,, +917,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Script ActiveX controls marked safe for scripting",,, +918,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Scripting of Java applets",,, +919,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Show security warning for potentially unsafe files",,, +920,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Cross-Site Scripting Filter",,, +921,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on Protected Mode",,, +922,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Turn on SmartScreen Filter scan",,, +923,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Use Pop-up Blocker",,, +924,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Userdata persistence",,, +925,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Restricted Sites Zone: Web sites in less privileged Web content zones can navigate into this zone",,, +926,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Don't run antimalware programs against ActiveX controls",,, +927,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Initialize and script ActiveX controls not marked as safe",,, +928,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Trusted Sites Zone: Java permissions",,, +843,"Administrative Templates: Windows Components","Internet Explorer: Internet Control Panel: Security Page: Turn on certificate address mismatch warning",,, +824,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings",,, +825,"Administrative Templates: Windows Components","Internet Explorer: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet",,, +826,"Administrative Templates: Windows Components","Internet Explorer: Prevent managing SmartScreen Filter",,, +827,"Administrative Templates: Windows Components","Internet Explorer: Prevent per-user installation of ActiveX controls",,, +930,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Remove 'Run this time' button for outdated ActiveX controls in Internet Explorer",,, +931,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Add-on Management: Turn off blocking of outdated ActiveX controls for Internet Explorer",,, +929,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Allow fallback to SSL 3.0 (Internet Explorer)",,, +934,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes (Reserved)",,, +933,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes explorer.exe",,, +932,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Consistent Mime Handling: Internet Explorer Processes iexplore.exe",,, +940,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes (Reserved)",,, +939,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes explorer.exe",,, +938,"Administrative Templates: Windows Components","Internet Explorer: Security Features: MK Protocol Security Restriction: Internet Explorer Processes iexplore.exe",,, +937,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes (Reserved)",,, +936,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes explore.exe",,, +935,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Mime Sniffing Safety Feature: Internet Explorer Processes iexplore.exe",,, +943,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes (Reserved)",,, +942,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes explorer.exe",,, +941,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Notification bar: Internet Explorer Processes iexplore.exe",,, +946,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes (Reserved)",,, +945,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes explorer.exe",,, +944,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Protection From Zone Elevation: Internet Explorer Processes iexplore.exe",,, +949,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes (Reserved)",,, +948,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes explorer.exe",,, +947,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict ActiveX Install: Internet Explorer Processes iexplore.exe",,, +952,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes (Reserved)",,, +951,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes explorer.exe",,, +950,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Restrict File Download: Internet Explorer Processes iexplore.exe",,, +955,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes (Reserved)",,, +954,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes explorer.exe",,, +953,"Administrative Templates: Windows Components","Internet Explorer: Security Features: Scripted Window Security Restrictions: Internet Explorer Processes iexplore.exe",,, +828,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to add/delete sites",,, +829,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Do not allow users to change policies",,, +830,"Administrative Templates: Windows Components","Internet Explorer: Security Zones: Use only machine settings",,, +831,"Administrative Templates: Windows Components","Internet Explorer: Specify use of ActiveX Installer Service for installation of ActiveX controls",,, +832,"Administrative Templates: Windows Components","Internet Explorer: Turn off Crash Detection",,, +833,"Administrative Templates: Windows Components","Internet Explorer: Turn off the Security Settings Check feature",,, +1694,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Ask)",,, +1693,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Control Panel)",,, +1692,"Administrative Templates: Windows Components","Internet Explorer: Turn on the auto-complete feature for user names and passwords on forms (Main)",,, +1636,"Administrative Templates: Windows Components","Location and Sensors: Turn off Windows Location Provider",,, +672,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",DE,"Administrative Vorlagen: Windows-Komponenten","Windows-Positionssuche: Speicherort deaktivieren" +673,"Administrative Templates: Windows Components","Messaging: Allow Message Service Cloud Sync",DE,"Administrative Vorlagen: Windows-Komponenten","Nachrichten: Synchronisierung von Nachrichtendienstcloud zulassen" +214,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Automatic sample submission",,, +213,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Cloud-delivered protection",,, +212,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",DE,"Microsoft Defender Antivirus","Konfigurieren der Erkennung für potenziell unerwünschte Anwendungen" +1788,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure local administrator merge behavior for lists",,, +1857,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether exclusions are visible to local users",,, +1789,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Control whether or not exclusions are visible to Local Admins",,, +215,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Controlled folder access",,, +1737,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable Tamper Protection (Status)",,, +1642,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable sandboxing for Microsoft Defender Antivirus",,, +1542,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions",,, +1539,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions (Policy)",,, +1543,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions",,, +1540,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions (Policy)",,, +1544,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions",,, +1541,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions (Policy)",,, +1525,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Turn off Auto Exclusions",,, +1858,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Features: Enable EDR in block mode",,, +675,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure local setting override for reporting to Microsoft MAPS",DE,"Microsoft Defender Antivirus","Konfigurieren der Außerkraftsetzung von lokalen Einstellungen für Berichte an Microsoft MAPS" +957,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",,, +676,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",DE,"Microsoft Defender Antivirus","Beitritt zu Microsoft MAPS" +956,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",,, +245,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",DE,"Microsoft Defender Exploit Guard","ASR: Adobe Reader am Erstellen von untergeordneten Prozessen hindern" +244,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Adobe Reader am Erstellen von untergeordneten Prozessen hindern (Richtlinie)" +227,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",DE,"Microsoft Defender Exploit Guard","ASR: JavaScript und VBScript am Starten heruntergeladener ausführbarer Inhalte hindern" +226,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: JavaScript und VBScript am Starten heruntergeladener ausführbarer Inhalte hindern (Richtlinie)" +223,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",DE,"Microsoft Defender Exploit Guard","ASR: Office-Anwendungen am Erstellen ausführbarer Inhalte hindern" +222,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Office-Anwendungen am Erstellen ausführbarer Inhalte hindern (Richtlinie)" +225,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",DE,"Microsoft Defender Exploit Guard","ASR: Office-Anwendungen am Einfügen von Code in untergeordnete Prozesse hindern" +224,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Office-Anwendungen am Einfügen von Code in untergeordnete Prozesse hindern (Richtlinie)" +243,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",DE,"Microsoft Defender Exploit Guard","ASR: Office-Kommunikationsanwendung am Erstellen von untergeordneten Prozessen hindern" +242,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Office-Kommunikationsanwendung am Erstellen von untergeordneten Prozessen hindern (Richtlinie)" +1823,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers",,, +1821,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Webshell creation for Servers (Policy)",,, +231,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",DE,"Microsoft Defender Exploit Guard","ASR: Win32-API-Aufrufe von Office-Makros blockieren" +230,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Win32-API-Aufrufe von Office-Makros blockieren (Richtlinie)" +1641,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",,, +1640,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",,, +221,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",DE,"Microsoft Defender Exploit Guard","ASR: Alle Office-Anwendungen am Erstellen von untergeordneten Prozessen hindern" +220,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Alle Office-Anwendungen am Erstellen von untergeordneten Prozessen hindern (Richtlinie)" +237,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",DE,"Microsoft Defender Exploit Guard","ASR: Diebstahl von Anmeldeinformationen aus dem Subsystem für die lokale Sicherheitsautorität (lsass.exe) blockieren" +236,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Diebstahl von Anmeldeinformationen aus dem Subsystem für die lokale Sicherheitsautorität (lsass.exe) blockieren (Richtlinie)" +219,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",DE,"Microsoft Defender Exploit Guard","ASR: Ausführbare Inhalte aus E-Mail-Client und Web-E-Mail blockieren" +218,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Ausführbare Inhalte aus E-Mail-Client und Web-E-Mail blockieren (Richtlinie)" +233,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",,, +232,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",,, +229,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",DE,"Microsoft Defender Exploit Guard","ASR: Ausführung potenziell verborgener Skripts blockieren" +228,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Ausführung potenziell verborgener Skripts blockieren (Richtlinie)" +247,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",,, +246,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",,, +239,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",,, +238,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",,, +1817,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode",,, +1815,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode (Policy)",,, +241,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",DE,"Microsoft Defender Exploit Guard","ASR: Nicht vertrauenswürdige und nicht signierte Prozess, die von USB ausgeführt werden, blockieren" +240,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",DE,"Microsoft Defender Exploit Guard","ASR: Nicht vertrauenswürdige und nicht signierte Prozess, die von USB ausgeführt werden, blockieren (Richtlinie)" +1820,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools",,, +1818,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools (Policy)",,, +1546,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules",,, +1545,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy)",,, +235,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",,, +234,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",,, +217,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",DE,"Microsoft Defender Exploit Guard","Regeln zur Verringerung der Angriffsfläche konfigurieren" +677,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",DE,"Microsoft Defender Exploit Guard","Netzwerkschutz: Benutzer- und App-Zugriff auf gefährliche Websites verhindern" +1866,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server",,, +1791,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Configure extended cloud check",,, +678,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",,, +958,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",,, +1859,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Network Inspection System: Convert warn verdict to block",,, +216,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real time monitoring",,, +1793,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure monitoring for incoming and outgoing file and program activity",,, +1860,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Configure real-time protection and Security Intelligence Updates during OOBE",,, +1794,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Monitor file and program activity on your computer",,, +959,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",,, +960,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",,, +679,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",DE,"Microsoft Defender Antivirus","Aktivieren der Verhaltensüberwachung" +1796,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on process scanning whenever real-time protection is enabled",,, +1653,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",,, +1899,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Brute-Force Protection aggressiveness",,, +1900,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Brute-Force Protection: Configure Remote Encryption Protection Mode",,, +1901,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Remediation: Behavioral Network Blocks: Remote Encryption Protection: Configure how aggressively Remote Encryption Protection blocks threats",,, +680,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure Watson events",DE,"Microsoft Defender Antivirus","Konfigurieren von Watson-Ereignissen" +1861,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Reporting: Configure whether to report Dynamic Signature dropped events",,, +1862,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan excluded files and directories during quick scans",,, +1795,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan packed executables",,, +681,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",DE,"Microsoft Defender Antivirus","Scan: Scannen von Wechseldatenträgern" +1526,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Specify the day of the week to run a scheduled scan",,, +1902,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Trigger a quick scan after X days without any scans",,, +682,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Turn on e-mail scanning",DE,"Microsoft Defender Antivirus","Scan: Aktivieren von E-Mail-Scans" +1527,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before spyware security intelligence is considered out of date",,, +1528,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Define the number of days before virus security intelligence is considered out of date",,, +1529,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Security Intelligence Updates: Specify the day of the week to check for security intelligence updates",,, +1863,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender daily security intelligence updates",,, +1864,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly engine updates",,, +1865,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Select the channel for Microsoft Defender monthly platform updates",,, +1530,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected",,, +1533,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: High (4)",,, +1531,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Low (1)",,, +1532,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Medium (2)",,, +1534,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Threats: Specify threat alert levels at which default action should not be taken when detected: Severe (5)",,, +211,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",DE,"Microsoft Defender Antivirus","Windows Defender Antivirus deaktivieren" +1790,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off routine remediation",,, +691,"Administrative Templates: Windows Components","Microsoft Edge: Allow Address bar drop-down list suggestions",,, +692,"Administrative Templates: Windows Components","Microsoft Edge: Allow Adobe Flash",,, +1275,"Administrative Templates: Windows Components","Microsoft Edge: Allow Basic authentication for HTTP",,, +693,"Administrative Templates: Windows Components","Microsoft Edge: Allow InPrivate Browsing",,, +694,"Administrative Templates: Windows Components","Microsoft Edge: Allow Sideloading of extension",,, +802,"Administrative Templates: Windows Components","Microsoft Edge: Allow certificates signed using SHA-1 when issued by local trust anchors (deprecated)",,, +1911,"Administrative Templates: Windows Components","Microsoft Edge: Allow software WebGL fallback using SwiftShader",,, +1646,"Administrative Templates: Windows Components","Microsoft Edge: Allow unconfigured sites to be reloaded in Internet Explorer mode",,, +809,"Administrative Templates: Windows Components","Microsoft Edge: Allow user-level native messaging hosts (installed without admin permissions)",,, +803,"Administrative Templates: Windows Components","Microsoft Edge: Allow users to proceed from the HTTPS warning page",,, +1662,"Administrative Templates: Windows Components","Microsoft Edge: Allow using the deprecated U2F Security Key API (deprecated)",,, +1784,"Administrative Templates: Windows Components","Microsoft Edge: Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode",,, +1659,"Administrative Templates: Windows Components","Microsoft Edge: Configure Edge Website Typo Protection",,, +811,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen",,, +812,"Administrative Templates: Windows Components","Microsoft Edge: Configure Microsoft Defender SmartScreen to block potentially unwanted apps",,, +696,"Administrative Templates: Windows Components","Microsoft Edge: Configure Password Manager",,, +697,"Administrative Templates: Windows Components","Microsoft Edge: Configure Pop-up Blocker",,, +720,"Administrative Templates: Windows Components","Microsoft Edge: Configure Windows Defender SmartScreen",DE,"Microsoft Edge","Windows Defender SmartScreen konfigurieren" +1925,"Administrative Templates: Windows Components","Microsoft Edge: Configure browser process code integrity guard setting",,, +695,"Administrative Templates: Windows Components","Microsoft Edge: Configure cookies",,, +698,"Administrative Templates: Windows Components","Microsoft Edge: Configure search suggestions in Address bar",,, +699,"Administrative Templates: Windows Components","Microsoft Edge: Configure the Adobe Flash Click-to-Run setting",,, +807,"Administrative Templates: Windows Components","Microsoft Edge: Control which extensions cannot be installed",,, +806,"Administrative Templates: Windows Components","Microsoft Edge: Default Adobe Flash setting (obsolete)",,, +1824,"Administrative Templates: Windows Components","Microsoft Edge: Dynamic Code Settings",,, +1654,"Administrative Templates: Windows Components","Microsoft Edge: Enable 3DES cipher suites in TLS",,, +1825,"Administrative Templates: Windows Components","Microsoft Edge: Enable Application Bound Encryption",,, +1926,"Administrative Templates: Windows Components","Microsoft Edge: Enable Process Isolation",,, +1655,"Administrative Templates: Windows Components","Microsoft Edge: Enable browser legacy extension point blocking",,, +1927,"Administrative Templates: Windows Components","Microsoft Edge: Enable renderer in app container",,, +810,"Administrative Templates: Windows Components","Microsoft Edge: Enable saving passwords to the password manager",,, +804,"Administrative Templates: Windows Components","Microsoft Edge: Enable site isolation for every site",,, +1928,"Administrative Templates: Windows Components","Microsoft Edge: Enable the network service sandbox",,, +1661,"Administrative Templates: Windows Components","Microsoft Edge: Enhance images enabled",,, +1929,"Administrative Templates: Windows Components","Microsoft Edge: Enhance the security state in Microsoft Edge",,, +1716,"Administrative Templates: Windows Components","Microsoft Edge: Force WebSQL to be enabled",,, +805,"Administrative Templates: Windows Components","Microsoft Edge: Minimum TLS version enabled",,, +700,"Administrative Templates: Windows Components","Microsoft Edge: Prevent access to the about:flags page in Microsoft Edge",,, +701,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for files",,, +721,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",DE,"Microsoft Edge","Umgehen der Windows Defender SmartScreen-Aufforderungen für Websites verhindern" +1690,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing Microsoft Defender SmartScreen prompts for sites",,, +814,"Administrative Templates: Windows Components","Microsoft Edge: Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads",,, +702,"Administrative Templates: Windows Components","Microsoft Edge: Prevent certificate error overrides",,, +703,"Administrative Templates: Windows Components","Microsoft Edge: Prevent using Localhost IP address for WebRTC",,, +1658,"Administrative Templates: Windows Components","Microsoft Edge: Show the Reload in Internet Explorer mode button in the toolbar",,, +1648,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context",,, +1656,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether the display-capture permissions-policy is checked or skipped",,, +1647,"Administrative Templates: Windows Components","Microsoft Edge: Specifies whether to allow insecure websites to make requests to more-private network endpoints",,, +808,"Administrative Templates: Windows Components","Microsoft Edge: Supported authentication schemes",,, +674,"Administrative Templates: Windows Components","Microsoft account: Block all consumer Microsoft account user authentication",DE,"Administrative Vorlagen: Windows-Komponenten","Microsoft-Konto: Benutzerauthentifizierung von Microsoft-Konten aller Anwender blockieren" +742,"Administrative Templates: Windows Components","Network Sharing: Prevent users from sharing files within their profile",DE,"Administrative Vorlagen: Windows-Komponenten","Netzwerkfreigabe: Verhindert, dass Benutzer Dateien innerhalb ihres Profils freigeben" +1649,"Administrative Templates: Windows Components","News and interests: Enable news and interests on the taskbar",,, +183,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",DE,"Administrative Vorlagen: Windows-Komponenten","OneDrive: Verwendung von OneDrive für die Dateispeicherung verhindern" +1637,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage on Windows 8.1",,, +704,"Administrative Templates: Windows Components","Push To Install: Turn off Push To Install service",DE,"Administrative Vorlagen: Windows-Komponenten","Pushinstallation ausführen: Pushinstallationdienst deaktivieren" +713,"Administrative Templates: Windows Components","RSS Feeds: Prevent downloading of enclosures",DE,"Administrative Vorlagen: Windows-Komponenten","RSS-Feeds: Herunterladen von Anlagen verhindern" +1904,"Administrative Templates: Windows Components","RSS Feeds: Turn on Basic feed authentication over HTTP",,, +1775,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",,, +184,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopverbindungs-Client: Speichern von Kennwörtern nicht zulassen" +185,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Remoteverbindungen für Benutzer mithilfe der Remotedesktopdienste zulassen" +798,"Administrative Templates: Windows Components","Remote Desktop Session Host: Connections: Restrict Remote Desktop Services users to a single Remote Desktop Services session",,, +1675,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Allow UI Automation redirection",,, +705,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow COM port redirection",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host/Geräte- und Ressourcenumleitung: COM-Anschlussumleitung nicht zulassen" +706,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow LPT port redirection",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host/Geräte- und Ressourcenumleitung: LPT-Anschlussumleitung nicht zulassen" +1776,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow WebAuthn redirection",,, +186,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host/Geräte- und Ressourcenumleitung: Laufwerkumleitung nicht zulassen" +1676,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow location redirection",,, +707,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow supported Plug and Play device redirection",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host/Geräte- und Ressourcenumleitung: Umleitung bei unterstützten Plug & Play-Geräten nicht zulassen" +1903,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",,, +187,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sicherheit: Bei der Verbindungsherstellung immer zur Kennworteingabe auffordern" +188,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sicherheit: Sichere RPC-Kommunikation anfordern" +708,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require use of specific security layer for remote (RDP) connections",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sicherheit: Verwendung einer bestimmten Sicherheitsstufe für Remoteverbindungen (RDP) ist erforderlich" +709,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require user authentication for remote connections by using Network Level Authentication",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sicherheit: Benutzerauthentifizierung mit Authentifizierung auf Netzwerkebene ist für Remoteverbindungen erforderlich" +189,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sicherheit: Verschlüsselungsstufe der Clientverbindung festlegen" +1553,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: End session when time limits are reached",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sitzungszeitlimits: Sitzung beenden, wenn Zeitlimit erreicht wird" +710,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for active but idle Remote Desktop Services sessions",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sitzungszeitlimits: Zeitlimit für aktive, aber im Leerlauf befindliche Remotedesktopdienste-Sitzungen festlegen" +711,"Administrative Templates: Windows Components","Remote Desktop Session Host: Session Time Limits: Set time limit for disconnected sessions",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Sitzungszeitlimits: Zeitlimit für getrennte Sitzungen festlegen" +712,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not delete temp folders upon exit",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Temporäre Ordner: Temporären Ordner beim Beenden nicht löschen" +799,"Administrative Templates: Windows Components","Remote Desktop Session Host: Temporary folders: Do not use temporary folders per session",DE,"Administrative Vorlagen: Windows-Komponenten","Remotedesktopsitzungs-Host: Temporäre Ordner: Keine temporären Ordner pro Sitzung verwenden" +190,"Administrative Templates: Windows Components","Search: Allow Cloud Search",DE,"Administrative Vorlagen: Windows-Komponenten","Suche: Cloudsuche zulassen" +191,"Administrative Templates: Windows Components","Search: Allow Cortana",,, +192,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",,, +193,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",DE,"Administrative Vorlagen: Windows-Komponenten","Suche: Indizieren verschlüsselter Dateien zulassen" +194,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",DE,"Administrative Vorlagen: Windows-Komponenten","Suche: Der Suche und Cortana die Nutzung von Positionsdaten erlauben" +1771,"Administrative Templates: Windows Components","Search: Allow search highlights",,, +195,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",,, +714,"Administrative Templates: Windows Components","Software Protection Platform: Turn off KMS Client Online AVS Validation",DE,"Administrative Vorlagen: Windows-Komponenten","Softwareschutz-Plattform: AVS-Onlineüberprüfung für KMS-Client ausschalten" +715,"Administrative Templates: Windows Components","Store: Disable all apps from Microsoft Store",DE,"Administrative Vorlagen: Windows-Komponenten","Store: Alle Apps aus dem Microsoft Store deaktivieren Hinweis: Der Name dieser Einstellung enthält einen Fehler hinsichtlich der Wortwahl zum Status, wann Store Apps deaktiviert oder aktiviert sind. Der korrekte Titel wäre ""Alle Apps aus dem Microsoft Store aktivieren""." +716,"Administrative Templates: Windows Components","Store: Only display the private store within the Microsoft Store",DE,"Administrative Vorlagen: Windows-Komponenten","Store: Nur privaten Store im Microsoft Store anzeigen" +717,"Administrative Templates: Windows Components","Store: Turn off Automatic Download and Install of updates",DE,"Administrative Vorlagen: Windows-Komponenten","Store: Automatisches Herunterladen und Installieren von Updates deaktivieren" +719,"Administrative Templates: Windows Components","Store: Turn off the Store application",DE,"Administrative Vorlagen: Windows-Komponenten","Store: Store-Anwendung deaktivieren" +718,"Administrative Templates: Windows Components","Store: Turn off the offer to update to the latest version of Windows",DE,"Administrative Vorlagen: Windows-Komponenten","Store: Deaktivieren des Angebots zum Update auf die aktuelle Version von Windows" +1554,"Administrative Templates: Windows Components","Text Input: Improve inking and typing recognition",DE,"Administrative Vorlagen: Windows-Komponenten","Texteingabe: Freihand- und Eingabeerkennung verbessern" +1677,"Administrative Templates: Windows Components","Widgets: Allow widgets",,, +203,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Client: Basic-Authentifizierung zulassen" +204,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Client: Unverschlüsselten Verkehr zulassen" +205,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Client: Digest-Authentifizierung nicht zulassen" +207,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Dienst: Basic-Authentifizierung zulassen" +206,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Dienst: Remoteserververwaltung über WinRM zulassen" +208,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Dienst: Unverschlüsselten Verkehr zulassen" +209,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",DE,"Administrative Vorlagen: Windows-Komponenten","WinRM-Dienst: Speichern von RunAs-Anmeldeinformationen durch WinRM nicht zulassen" +1914,"Administrative Templates: Windows Components","Windows AI: Allow Recall to be enabled",,, +1797,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows",,, +1798,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows (User)",,, +1803,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",,, +1812,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Automatic Data Collection",,, +1709,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Enhanced Phishing Protection",,, +1915,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen",,, +1916,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",,, +1772,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Malicious",,, +1710,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Password Reuse",,, +1711,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Notify Unsafe App",,, +1712,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Service Enabled",,, +1639,"Administrative Templates: Windows Components","Windows Error Reporting: Automatically send memory dumps for OS-generated error reports",,, +1638,"Administrative Templates: Windows Components","Windows Error Reporting: Consent: Configure Default consent",,, +196,"Administrative Templates: Windows Components","Windows Error Reporting: Disable Windows Error Reporting",,, +197,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",DE,"Administrative Vorlagen: Windows-Komponenten","Windows-Spielaufzeichnung und -übertragung: Aktiviert oder deaktiviert die Windows-Spieleaufzeichnung und -übertragung" +1773,"Administrative Templates: Windows Components","Windows Hello for Business: Enable ESS with Supported Peripherals",,, +963,"Administrative Templates: Windows Components","Windows Hello for Business: Use a hardware security device",,, +198,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Ink-Arbeitsbereich: Windows Ink-Arbeitsbereich zulassen" +734,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow suggested apps in Windows Ink Workspace",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Ink-Arbeitsbereich: Vorgeschlagene Apps im Windows Ink-Arbeitsbereich zulassen" +200,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Installer: Benutzersteuerung bei Installationen zulassen" +199,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Installer: Immer mit erhöhten Rechten installieren" +303,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Installer: Immer mit erhöhten Rechten installieren" +1657,"Administrative Templates: Windows Components","Windows Installer: Disable Co-Installer (USB AutoInstall)",,, +201,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Installer: IE-Sicherheitshinweis für Windows Installer-Skripts verhindern" +1713,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",,, +202,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",DE,"Administrative Vorlagen: Windows-Komponenten","Windows-Anmeldeoptionen: Automatisches Anmelden des letzten interaktiven Benutzers nach einem vom System initiierten Neustart" +744,"Administrative Templates: Windows Components","Windows Media Player: Playback: Prevent Codec Download",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Media Player: Wiedergabe: Codec-Download verhindern" +268,"Administrative Templates: Windows Components","Windows PowerShell: Disable PowerShell version 2",,, +269,"Administrative Templates: Windows Components","Windows PowerShell: Disable PowerShell version 2 (root)",,, +307,"Administrative Templates: Windows Components","Windows PowerShell: PowerShell Language Mode",,, +1739,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",,, +1742,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",,, +1740,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",,, +1743,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",,, +265,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",,, +304,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",,, +266,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",,, +305,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",,, +267,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",,, +306,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",,, +1741,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",,, +1744,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",,, +1556,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution",DE,PowerShell,"Skriptausführung aktivieren" +1555,"Administrative Templates: Windows Components","Windows PowerShell: Turn on Script Execution (Execution Policy)",DE,PowerShell,"Skriptausführung aktivieren (Execution Policy)" +210,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",DE,"Administrative Vorlagen: Windows-Komponenten","Windows-Remoteshell: Remoteshellzugriff zulassen" +1678,"Administrative Templates: Windows Components","Windows Sandbox: Allow clipboard sharing with Windows Sandbox",,, +1905,"Administrative Templates: Windows Components","Windows Sandbox: Allow mapping folders into Windows Sandbox",,, +1679,"Administrative Templates: Windows Components","Windows Sandbox: Allow networking in Windows Sandbox",,, +1557,"Administrative Templates: Windows Components","Windows Update: Configure Automatic Updates: Configure automatic updating",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Update: Automatische Updates konfigurieren" +732,"Administrative Templates: Windows Components","Windows Update: Legacy Policies: No auto-restart with logged on users for scheduled automatic updates installations",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Update: Keinen automatischen Neustart für geplante Installationen automatischer Updates durchführen, wenn Benutzer angemeldet sind" +730,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Update: Automatische Updates konfigurieren" +731,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Configure Automatic Updates: Scheduled install day",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Update: Automatische Updates konfigurieren: Geplanter Installationstag" +1813,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Enable features introduced via servicing that are off by default",,, +733,"Administrative Templates: Windows Components","Windows Update: Manage end user experience: Remove access to 'Pause updates' feature",DE,"Administrative Vorlagen: Windows-Komponenten","Windows Update: Zugriff auf Feature ""Updates aussetzen"" entfernen" +1814,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Enable optional updates",,, +723,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuilds)",,, +724,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Manage preview builds (ManagePreviewBuildsPolicyValue)",,, +726,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (BranchReadinessLevel)",,, +725,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdates)",,, +727,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Preview Builds and Feature Updates are received (DeferFeatureUpdatesPeriodInDays)",,, +728,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdates)",,, +729,"Administrative Templates: Windows Components","Windows Update: Manage updates offered from Windows Update: Select when Quality Updates are received (DeferQualityUpdatesPeriodInDays)",,, +78,"Advanced Audit Policy Configuration","Account Lockout",,, +524,"Advanced Audit Policy Configuration","Application Group Management",,, +89,"Advanced Audit Policy Configuration","Audit Policy Change",,, +90,"Advanced Audit Policy Configuration","Authentication Policy Change",,, +526,"Advanced Audit Policy Configuration","Authorization Policy Change",,, +779,"Advanced Audit Policy Configuration","Computer Account Management",,, +72,"Advanced Audit Policy Configuration","Credential Validation",,, +75,"Advanced Audit Policy Configuration","DPAPI Activity",,, +83,"Advanced Audit Policy Configuration","Detailed File Share",,, +782,"Advanced Audit Policy Configuration","Directory Service Access",,, +783,"Advanced Audit Policy Configuration","Directory Service Changes",,, +780,"Advanced Audit Policy Configuration","Distribution Group Management",,, +84,"Advanced Audit Policy Configuration","File Share",,, +79,"Advanced Audit Policy Configuration","Group Membership",,, +527,"Advanced Audit Policy Configuration","IPsec Driver",,, +777,"Advanced Audit Policy Configuration","Kerberos Authentication Service",,, +778,"Advanced Audit Policy Configuration","Kerberos Service Ticket Operations",,, +85,"Advanced Audit Policy Configuration","Kernel Object",,, +525,"Advanced Audit Policy Configuration",Logoff,,, +80,"Advanced Audit Policy Configuration",Logon,,, +91,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",,, +781,"Advanced Audit Policy Configuration","Other Account Management Events",,, +81,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",,, +86,"Advanced Audit Policy Configuration","Other Object Access Events",,, +92,"Advanced Audit Policy Configuration","Other Policy Change Events",,, +94,"Advanced Audit Policy Configuration","Other System Events",,, +76,"Advanced Audit Policy Configuration","Plug and Play Events",,, +77,"Advanced Audit Policy Configuration","Process Creation",,, +87,"Advanced Audit Policy Configuration","Removable Storage",,, +88,"Advanced Audit Policy Configuration",SAM,,, +73,"Advanced Audit Policy Configuration","Security Group Management",,, +95,"Advanced Audit Policy Configuration","Security State Change",,, +96,"Advanced Audit Policy Configuration","Security System Extension",,, +93,"Advanced Audit Policy Configuration","Sensitive Privilege Use",,, +82,"Advanced Audit Policy Configuration","Special Logon",,, +97,"Advanced Audit Policy Configuration","System Integrity",,, +74,"Advanced Audit Policy Configuration","User Account Management",,, +1,Features,"SMBv1 Support",,, +1910,"MS Security Guide","Add Extended Protection for LDAP Authentication (Domain Controllers only)",,, +537,"MS Security Guide","Apply UAC restrictions to local accounts on network logons",DE,"MS Security Guide","Apply UAC restrictions to local accounts on network logons" +790,"MS Security Guide","Apply UAC restrictions to local accounts on network logons (Member)",,, +1696,"MS Security Guide","Configure RPC packet level privacy setting for incoming connections",,, +538,"MS Security Guide","Configure SMB v1 client driver",DE,"MS Security Guide","Configure SMB v1 client driver" +539,"MS Security Guide","Configure SMB v1 server",DE,"MS Security Guide","Configure SMB v1 server" +1801,"MS Security Guide","Enable Certificate Padding",,, +1912,"MS Security Guide","Enable Certificate Padding (32-bit subsystem on 64-bit OS)",,, +540,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",DE,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)" +791,"MS Security Guide","Extended Protection for LDAP Authentication (DC)",,, +270,"MS Security Guide","LSA Protection",DE,"MS Security Guide","LSA Protection" +1652,"MS Security Guide","Limits print driver installation to Administrators",,, +271,"MS Security Guide","Lsass.exe audit mode",,, +1715,"MS Security Guide","Manage processing of Queue-specific files",,, +272,"MS Security Guide","NetBT NodeType configuration",DE,"MS Security Guide","NetBT NodeType configuration" +1324,"MS Security Guide","Remove ""Run As Different User"" from context menus (batfile)",,, +1325,"MS Security Guide","Remove ""Run As Different User"" from context menus (cmdfile)",,, +1326,"MS Security Guide","Remove ""Run As Different User"" from context menus (exefile)",,, +1327,"MS Security Guide","Remove ""Run As Different User"" from context menus (mscfile)",,, +273,"MS Security Guide","WDigest Authentication",DE,"MS Security Guide","WDigest Authentication" +541,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)",DE,"MSS (Legacy)","MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" +542,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",DE,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" +543,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",DE,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" +544,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved",DE,"MSS (Legacy)","MSS: (DisableSavePassword) Prevent the dial-up password from being saved" +1547,"MSS (Legacy)","MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)",DE,"MSS (Legacy)","MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)" +545,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",DE,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" +546,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds",DE,"MSS (Legacy)","MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds" +547,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",DE,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" +548,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)",DE,"MSS (Legacy)","MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)" +274,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",DE,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)" +549,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)",DE,"MSS (Legacy)","MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)" +550,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted",DE,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted" +551,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted",DE,"MSS (Legacy)","MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted" +552,"MSS (Legacy)","MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning",,, +685,"Microsoft Defender Application Guard","Allow auditing events in Microsoft Defender Application Guard",,, +686,"Microsoft Defender Application Guard","Allow camera and microphone access in Microsoft Defender Application Guard",,, +687,"Microsoft Defender Application Guard","Allow data persistence for Microsoft Defender Application Guard",,, +688,"Microsoft Defender Application Guard","Allow files to download and save to the host operating system from Microsoft Defender Application Guard",,, +1314,"Microsoft Defender Application Guard","Allow users to trust files that open in Windows Defender Application Guard",,, +689,"Microsoft Defender Application Guard","Configure Microsoft Defender Application Guard clipboard settings: Clipboard behavior setting",,, +1306,"Microsoft Defender Application Guard","Support for Microsoft Defender Application Guard",,, +690,"Microsoft Defender Application Guard","Turn on Microsoft Defender Application Guard in Managed Mode",,, +1362,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (GROOVE.EXE)",,, +1352,"Microsoft Defender Exploit Guard","Exploit protection: Child Process: Override Child Process (fltldr.exe)",,, +248,"Microsoft Defender Exploit Guard","Exploit protection: Control flow guard (CFG)",,, +249,"Microsoft Defender Exploit Guard","Exploit protection: Data Execution Prevention (DEP)",,, +1372,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (AcroRd32.exe)",,, +1364,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (Acrobat.exe)",,, +1381,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (EXCEL.EXE)",,, +1354,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (GROOVE.EXE)",,, +1397,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (INFOPATH.EXE)",,, +1426,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (LYNC.EXE)",,, +1434,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSACCESS.EXE)",,, +1442,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (MSPUB.EXE)",,, +1334,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (ONEDRIVE.EXE)",,, +1457,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (OUTLOOK.EXE)",,, +1472,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (POWERPNT.EXE)",,, +1480,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (PPTVIEW.EXE)",,, +1488,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VISIO.EXE)",,, +1496,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (VPREVIEW.EXE)",,, +1504,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (WINWORD.EXE)",,, +1343,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (firefox.exe)",,, +1389,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (ASLR) (iexplore.exe)",,, +252,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (Mandatory ASLR)",,, +256,"Microsoft Defender Exploit Guard","Exploit protection: High-entropy ASLR",,, +1361,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (GROOVE.EXE)",,, +1341,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (ONEDRIVE.EXE)",,, +1350,"Microsoft Defender Exploit Guard","Exploit protection: ImageLoad: Override Block Remote Images (fltldr.exe)",,, +250,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP)",,, +1371,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (AcroRd32.exe)",,, +1363,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (Acrobat.exe)",,, +1380,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (EXCEL.EXE)",,, +1353,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (GROOVE.EXE)",,, +1396,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (INFOPATH.EXE)",,, +1425,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (LYNC.EXE)",,, +1433,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSACCESS.EXE)",,, +1441,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (MSPUB.EXE)",,, +1449,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OIS.EXE)",,, +1332,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (ONEDRIVE.EXE)",,, +1456,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (OUTLOOK.EXE)",,, +1471,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (POWERPNT.EXE)",,, +1479,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (PPTVIEW.EXE)",,, +1487,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VISIO.EXE)",,, +1495,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (VPREVIEW.EXE)",,, +1503,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (WINWORD.EXE)",,, +1379,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (chrome.exe)",,, +1342,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (firefox.exe)",,, +1351,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (fltldr.exe)",,, +1388,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (iexplore.exe)",,, +1404,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (java.exe)",,, +1411,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaw.exe)",,, +1418,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (javaws.exe)",,, +1464,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (plugin-container.exe)",,, +1511,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wmplayer.exe)",,, +1518,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP) (wordpad.exe)",,, +1333,"Microsoft Defender Exploit Guard","Exploit protection: Override Relocate Images (ASLR) (ONEDRIVE.EXE)",,, +253,"Microsoft Defender Exploit Guard","Exploit protection: Override force randomization for images (Mandatory ASLR)",,, +257,"Microsoft Defender Exploit Guard","Exploit protection: Override high-entropy ASLR",,, +255,"Microsoft Defender Exploit Guard","Exploit protection: Override randomize memory allocations (Bottom-up ASLR)",,, +260,"Microsoft Defender Exploit Guard","Exploit protection: Override validate exception chains (SEHOP)",,, +262,"Microsoft Defender Exploit Guard","Exploit protection: Override validate heap integrity",,, +1373,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (AcroRd32.exe)",,, +1365,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (Acrobat.exe)",,, +1382,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (EXCEL.EXE)",,, +1355,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (GROOVE.EXE)",,, +1398,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (INFOPATH.EXE)",,, +1427,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (LYNC.EXE)",,, +1435,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSACCESS.EXE)",,, +1443,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (MSPUB.EXE)",,, +1450,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OIS.EXE)",,, +1335,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (ONEDRIVE.EXE)",,, +1458,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (OUTLOOK.EXE)",,, +1473,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (POWERPNT.EXE)",,, +1505,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (WINWORD.EXE)",,, +1344,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (fltldr.exe)",,, +1390,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (iexplore.exe)",,, +1405,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (java.exe)",,, +1412,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaw.exe)",,, +1419,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (javaws.exe)",,, +1465,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (plugin-container.exe)",,, +1512,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wmplayer.exe)",,, +1519,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter (wordpad.exe)",,, +1374,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (AcroRd32.exe)",,, +1366,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (Acrobat.exe)",,, +1383,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (EXCEL.EXE)",,, +1356,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (GROOVE.EXE)",,, +1399,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (INFOPATH.EXE)",,, +1428,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (LYNC.EXE)",,, +1436,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSACCESS.EXE)",,, +1444,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (MSPUB.EXE)",,, +1451,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OIS.EXE)",,, +1336,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (ONEDRIVE.EXE)",,, +1459,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (OUTLOOK.EXE)",,, +1474,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (POWERPNT.EXE)",,, +1482,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (PPTVIEW.EXE)",,, +1490,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VISIO.EXE)",,, +1498,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (VPREVIEW.EXE)",,, +1506,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (WINWORD.EXE)",,, +1345,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (fltldr.exe)",,, +1391,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (iexplore.exe)",,, +1406,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (java.exe)",,, +1413,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaw.exe)",,, +1420,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (javaws.exe)",,, +1466,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (plugin-container.exe)",,, +1513,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wmplayer.exe)",,, +1520,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export Address Filter Plus (wordpad.exe)",,, +1481,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (PPTVIEW.EXE)",,, +1489,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VISIO.EXE)",,, +1497,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Export AddressFilter (VPREVIEW.EXE)",,, +1375,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (AcroRd32.exe)",,, +1367,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (Acrobat.exe)",,, +1384,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (EXCEL.EXE)",,, +1357,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (GROOVE.EXE)",,, +1400,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (INFOPATH.EXE)",,, +1429,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (LYNC.EXE)",,, +1437,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSACCESS.EXE)",,, +1445,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (MSPUB.EXE)",,, +1452,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OIS.EXE)",,, +1337,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (ONEDRIVE.EXE)",,, +1460,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (OUTLOOK.EXE)",,, +1475,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (POWERPNT.EXE)",,, +1483,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (PPTVIEW.EXE)",,, +1491,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VISIO.EXE)",,, +1499,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (VPREVIEW.EXE)",,, +1507,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (WINWORD.EXE)",,, +1346,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (fltldr.exe)",,, +1392,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (iexplore.exe)",,, +1407,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (java.exe)",,, +1414,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaw.exe)",,, +1421,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (javaws.exe)",,, +1467,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (plugin-container.exe)",,, +1514,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wmplayer.exe)",,, +1521,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable Import Address Filter (wordpad.exe)",,, +1377,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (AcroRd32.exe)",,, +1369,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (Acrobat.exe)",,, +1386,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (EXCEL.EXE)",,, +1359,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (GROOVE.EXE)",,, +1402,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (INFOPATH.EXE)",,, +1431,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (LYNC.EXE)",,, +1439,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSACCESS.EXE)",,, +1447,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (MSPUB.EXE)",,, +1454,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OIS.EXE)",,, +1339,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (ONEDRIVE.EXE)",,, +1462,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (OUTLOOK.EXE)",,, +1477,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (POWERPNT.EXE)",,, +1485,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (PPTVIEW.EXE)",,, +1493,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VISIO.EXE)",,, +1501,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (VPREVIEW.EXE)",,, +1509,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (WINWORD.EXE)",,, +1348,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (fltldr.exe)",,, +1394,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (iexplore.exe)",,, +1409,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (java.exe)",,, +1416,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaw.exe)",,, +1423,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (javaws.exe)",,, +1469,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (plugin-container.exe)",,, +1516,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wmplayer.exe)",,, +1523,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Caller Check (wordpad.exe)",,, +1378,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (AcroRd32.exe)",,, +1370,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (Acrobat.exe)",,, +1387,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (EXCEL.EXE)",,, +1360,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (GROOVE.EXE)",,, +1403,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (INFOPATH.EXE)",,, +1432,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (LYNC.EXE)",,, +1440,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSACCESS.EXE)",,, +1448,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (MSPUB.EXE)",,, +1455,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OIS.EXE)",,, +1340,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (ONEDRIVE.EXE)",,, +1463,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (OUTLOOK.EXE)",,, +1478,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (POWERPNT.EXE)",,, +1486,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (PPTVIEW.EXE)",,, +1494,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VISIO.EXE)",,, +1502,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (VPREVIEW.EXE)",,, +1510,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (WINWORD.EXE)",,, +1349,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (fltldr.exe)",,, +1395,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (iexplore.exe)",,, +1410,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (java.exe)",,, +1417,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaw.exe)",,, +1424,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (javaws.exe)",,, +1470,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (plugin-container.exe)",,, +1517,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wmplayer.exe)",,, +1524,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Sim Exec (wordpad.exe)",,, +1376,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (AcroRd32.exe)",,, +1368,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (Acrobat.exe)",,, +1385,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (EXCEL.EXE)",,, +1358,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (GROOVE.EXE)",,, +1401,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (INFOPATH.EXE)",,, +1430,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (LYNC.EXE)",,, +1438,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSACCESS.EXE)",,, +1446,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (MSPUB.EXE)",,, +1453,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OIS.EXE)",,, +1338,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (ONEDRIVE.EXE)",,, +1461,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (OUTLOOK.EXE)",,, +1476,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (POWERPNT.EXE)",,, +1484,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (PPTVIEW.EXE)",,, +1492,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VISIO.EXE)",,, +1500,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (VPREVIEW.EXE)",,, +1508,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (WINWORD.EXE)",,, +1347,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (fltldr.exe)",,, +1393,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (iexplore.exe)",,, +1408,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (java.exe)",,, +1415,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaw.exe)",,, +1422,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (javaws.exe)",,, +1468,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (plugin-container.exe)",,, +1515,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wmplayer.exe)",,, +1522,"Microsoft Defender Exploit Guard","Exploit protection: Payload: Override Enable ROP Stack Pivot (wordpad.exe)",,, +254,"Microsoft Defender Exploit Guard","Exploit protection: Randomize memory allocations (Bottom-up ASLR)",,, +259,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP (Telemetry only)",,, +258,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP)",,, +261,"Microsoft Defender Exploit Guard","Exploit protection: Validate heap integrity",,, +251,"Microsoft Defender Exploit Guard","Force use of Data Execution Prevention (DEP)",,, +1331,"Microsoft Defender Exploit Guard","Use a common set of exploit protection settings",,, +1000,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Access)",,, +1001,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Excel)",,, +1002,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Infopath)",,, +1003,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Outlook)",,, +1004,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (PowerPoint)",,, +1005,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Project)",,, +1006,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Publisher)",,, +1007,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Visio)",,, +1008,"Office 2016 / Office 365","Global Options: Disable UI extending from documents and templates (Word)",,, +1093,"Office 2016 / Office 365","IE Security: Add-on Management (Access)",,, +1090,"Office 2016 / Office 365","IE Security: Add-on Management (Excel)",,, +1091,"Office 2016 / Office 365","IE Security: Add-on Management (Expression Web Designer)",,, +1092,"Office 2016 / Office 365","IE Security: Add-on Management (Groove)",,, +1096,"Office 2016 / Office 365","IE Security: Add-on Management (OneNote)",,, +1097,"Office 2016 / Office 365","IE Security: Add-on Management (Outlook)",,, +1099,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint Viewer)",,, +1098,"Office 2016 / Office 365","IE Security: Add-on Management (PowerPoint)",,, +1102,"Office 2016 / Office 365","IE Security: Add-on Management (Project)",,, +1095,"Office 2016 / Office 365","IE Security: Add-on Management (Publisher)",,, +1094,"Office 2016 / Office 365","IE Security: Add-on Management (Script Editor)",,, +1100,"Office 2016 / Office 365","IE Security: Add-on Management (SharePoint Designer)",,, +1101,"Office 2016 / Office 365","IE Security: Add-on Management (Visio)",,, +1103,"Office 2016 / Office 365","IE Security: Add-on Management (Word)",,, +1107,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Access)",,, +1104,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Excel)",,, +1105,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Expression Web Designer)",,, +1106,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Groove)",,, +1110,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (OneNote)",,, +1111,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Outlook)",,, +1113,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint Viewer)",,, +1112,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (PowerPoint)",,, +1116,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Project)",,, +1109,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Publisher)",,, +1108,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Script Editor)",,, +1114,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (SharePoint Designer)",,, +1115,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Visio)",,, +1117,"Office 2016 / Office 365","IE Security: Consistent Mime Handling (Word)",,, +1121,"Office 2016 / Office 365","IE Security: Disable user name and password (Access)",,, +1118,"Office 2016 / Office 365","IE Security: Disable user name and password (Excel)",,, +1119,"Office 2016 / Office 365","IE Security: Disable user name and password (Expression Web Designer)",,, +1120,"Office 2016 / Office 365","IE Security: Disable user name and password (Groove)",,, +1124,"Office 2016 / Office 365","IE Security: Disable user name and password (OneNote)",,, +1125,"Office 2016 / Office 365","IE Security: Disable user name and password (Outlook)",,, +1127,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint Viewer)",,, +1126,"Office 2016 / Office 365","IE Security: Disable user name and password (PowerPoint)",,, +1130,"Office 2016 / Office 365","IE Security: Disable user name and password (Project)",,, +1123,"Office 2016 / Office 365","IE Security: Disable user name and password (Publisher)",,, +1122,"Office 2016 / Office 365","IE Security: Disable user name and password (Script Editor)",,, +1128,"Office 2016 / Office 365","IE Security: Disable user name and password (SharePoint Designer)",,, +1129,"Office 2016 / Office 365","IE Security: Disable user name and password (Visio)",,, +1131,"Office 2016 / Office 365","IE Security: Disable user name and password (Word)",,, +1135,"Office 2016 / Office 365","IE Security: Information Bar (Access)",,, +1132,"Office 2016 / Office 365","IE Security: Information Bar (Excel)",,, +1133,"Office 2016 / Office 365","IE Security: Information Bar (Expression Web Designer)",,, +1134,"Office 2016 / Office 365","IE Security: Information Bar (Groove)",,, +1138,"Office 2016 / Office 365","IE Security: Information Bar (OneNote)",,, +1139,"Office 2016 / Office 365","IE Security: Information Bar (Outlook)",,, +1141,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint Viewer)",,, +1140,"Office 2016 / Office 365","IE Security: Information Bar (PowerPoint)",,, +1144,"Office 2016 / Office 365","IE Security: Information Bar (Project)",,, +1137,"Office 2016 / Office 365","IE Security: Information Bar (Publisher)",,, +1136,"Office 2016 / Office 365","IE Security: Information Bar (Script Editor)",,, +1142,"Office 2016 / Office 365","IE Security: Information Bar (SharePoint Designer)",,, +1143,"Office 2016 / Office 365","IE Security: Information Bar (Visio)",,, +1145,"Office 2016 / Office 365","IE Security: Information Bar (Word)",,, +1149,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Access)",,, +1146,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Excel)",,, +1147,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Expression Web Designer)",,, +1148,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Groove)",,, +1152,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (OneNote)",,, +1153,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Outlook)",,, +1155,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint Viewer)",,, +1154,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (PowerPoint)",,, +1158,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Project)",,, +1151,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Publisher)",,, +1150,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Script Editor)",,, +1156,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (SharePoint Designer)",,, +1157,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Visio)",,, +1159,"Office 2016 / Office 365","IE Security: Local Machine Zone Lockdown Security (Word)",,, +1163,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Access)",,, +1160,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Excel)",,, +1161,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Expression Web Designer)",,, +1162,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Groove)",,, +1166,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (OneNote)",,, +1167,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Outlook)",,, +1169,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint Viewer)",,, +1168,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (PowerPoint)",,, +1172,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Project)",,, +1165,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Publisher)",,, +1164,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Script Editor)",,, +1170,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (SharePoint Designer)",,, +1171,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Visio)",,, +1173,"Office 2016 / Office 365","IE Security: Mime Sniffing Safety Feature (Word)",,, +1177,"Office 2016 / Office 365","IE Security: Navigate URL (Access)",,, +1174,"Office 2016 / Office 365","IE Security: Navigate URL (Excel)",,, +1175,"Office 2016 / Office 365","IE Security: Navigate URL (Expression Web Designer)",,, +1176,"Office 2016 / Office 365","IE Security: Navigate URL (Groove)",,, +1180,"Office 2016 / Office 365","IE Security: Navigate URL (OneNote)",,, +1181,"Office 2016 / Office 365","IE Security: Navigate URL (Outlook)",,, +1183,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint Viewer)",,, +1182,"Office 2016 / Office 365","IE Security: Navigate URL (PowerPoint)",,, +1186,"Office 2016 / Office 365","IE Security: Navigate URL (Project)",,, +1179,"Office 2016 / Office 365","IE Security: Navigate URL (Publisher)",,, +1178,"Office 2016 / Office 365","IE Security: Navigate URL (Script Editor)",,, +1184,"Office 2016 / Office 365","IE Security: Navigate URL (SharePoint Designer)",,, +1185,"Office 2016 / Office 365","IE Security: Navigate URL (Visio)",,, +1187,"Office 2016 / Office 365","IE Security: Navigate URL (Word)",,, +1191,"Office 2016 / Office 365","IE Security: Object Caching Protection (Access)",,, +1188,"Office 2016 / Office 365","IE Security: Object Caching Protection (Excel)",,, +1189,"Office 2016 / Office 365","IE Security: Object Caching Protection (Expression Web Designer)",,, +1190,"Office 2016 / Office 365","IE Security: Object Caching Protection (Groove)",,, +1194,"Office 2016 / Office 365","IE Security: Object Caching Protection (OneNote)",,, +1195,"Office 2016 / Office 365","IE Security: Object Caching Protection (Outlook)",,, +1197,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint Viewer)",,, +1196,"Office 2016 / Office 365","IE Security: Object Caching Protection (PowerPoint)",,, +1200,"Office 2016 / Office 365","IE Security: Object Caching Protection (Project)",,, +1193,"Office 2016 / Office 365","IE Security: Object Caching Protection (Publisher)",,, +1192,"Office 2016 / Office 365","IE Security: Object Caching Protection (Script Editor)",,, +1198,"Office 2016 / Office 365","IE Security: Object Caching Protection (SharePoint Designer)",,, +1199,"Office 2016 / Office 365","IE Security: Object Caching Protection (Visio)",,, +1201,"Office 2016 / Office 365","IE Security: Object Caching Protection (Word)",,, +1205,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Access)",,, +1202,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Excel)",,, +1203,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Expression Web Designer)",,, +1204,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Groove)",,, +1208,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (OneNote)",,, +1209,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Outlook)",,, +1211,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint Viewer)",,, +1210,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (PowerPoint)",,, +1214,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Project)",,, +1207,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Publisher)",,, +1206,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Script Editor)",,, +1212,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (SharePoint Designer)",,, +1213,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Visio)",,, +1215,"Office 2016 / Office 365","IE Security: Protection From Zone Elevation (Word)",,, +1219,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Access)",,, +1216,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Excel)",,, +1217,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Expression Web Designer)",,, +1218,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Groove)",,, +1222,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (OneNote)",,, +1223,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Outlook)",,, +1225,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint Viewer)",,, +1224,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (PowerPoint)",,, +1228,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Project)",,, +1221,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Publisher)",,, +1220,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Script Editor)",,, +1226,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (SharePoint Designer)",,, +1227,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Visio)",,, +1229,"Office 2016 / Office 365","IE Security: Restrict ActiveX Install (Word)",,, +1233,"Office 2016 / Office 365","IE Security: Restrict File Download (Access)",,, +1230,"Office 2016 / Office 365","IE Security: Restrict File Download (Excel)",,, +1231,"Office 2016 / Office 365","IE Security: Restrict File Download (Expression Web Designer)",,, +1232,"Office 2016 / Office 365","IE Security: Restrict File Download (Groove)",,, +1236,"Office 2016 / Office 365","IE Security: Restrict File Download (OneNote)",,, +1237,"Office 2016 / Office 365","IE Security: Restrict File Download (Outlook)",,, +1239,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint Viewer)",,, +1238,"Office 2016 / Office 365","IE Security: Restrict File Download (PowerPoint)",,, +1242,"Office 2016 / Office 365","IE Security: Restrict File Download (Project)",,, +1235,"Office 2016 / Office 365","IE Security: Restrict File Download (Publisher)",,, +1234,"Office 2016 / Office 365","IE Security: Restrict File Download (Script Editor)",,, +1240,"Office 2016 / Office 365","IE Security: Restrict File Download (SharePoint Designer)",,, +1241,"Office 2016 / Office 365","IE Security: Restrict File Download (Visio)",,, +1243,"Office 2016 / Office 365","IE Security: Restrict File Download (Word)",,, +1247,"Office 2016 / Office 365","IE Security: Saved from URL (Access)",,, +1244,"Office 2016 / Office 365","IE Security: Saved from URL (Excel)",,, +1245,"Office 2016 / Office 365","IE Security: Saved from URL (Expression Web Designer)",,, +1246,"Office 2016 / Office 365","IE Security: Saved from URL (Groove)",,, +1250,"Office 2016 / Office 365","IE Security: Saved from URL (OneNote)",,, +1251,"Office 2016 / Office 365","IE Security: Saved from URL (Outlook)",,, +1253,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint Viewer)",,, +1252,"Office 2016 / Office 365","IE Security: Saved from URL (PowerPoint)",,, +1256,"Office 2016 / Office 365","IE Security: Saved from URL (Project)",,, +1249,"Office 2016 / Office 365","IE Security: Saved from URL (Publisher)",,, +1248,"Office 2016 / Office 365","IE Security: Saved from URL (Script Editor)",,, +1254,"Office 2016 / Office 365","IE Security: Saved from URL (SharePoint Designer)",,, +1255,"Office 2016 / Office 365","IE Security: Saved from URL (Visio)",,, +1257,"Office 2016 / Office 365","IE Security: Saved from URL (Word)",,, +1261,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Access)",,, +1258,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Excel)",,, +1259,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Expression Web Designer)",,, +1260,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Groove)",,, +1264,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (OneNote)",,, +1265,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Outlook)",,, +1267,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint Viewer)",,, +1266,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (PowerPoint)",,, +1270,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Project)",,, +1263,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Publisher)",,, +1262,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Script Editor)",,, +1268,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (SharePoint Designer)",,, +1269,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Visio)",,, +1271,"Office 2016 / Office 365","IE Security: Scripted Window Security Restrictions (Word)",,, +1272,"Office 2016 / Office 365","MS Security Guide: Block Flash activation in Office documents",,, +968,"Office 2016 / Office 365","Microsoft Access: Allow Trusted Locations on the network",,, +965,"Office 2016 / Office 365","Microsoft Access: Block macros from running in Office files from the Internet",,, +966,"Office 2016 / Office 365","Microsoft Access: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +967,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy)",,, +1868,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1869,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1302,"Office 2016 / Office 365","Microsoft Access: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +311,"Office 2016 / Office 365","Microsoft Excel: Allow DDE",,, +999,"Office 2016 / Office 365","Microsoft Excel: Allow Trusted Locations on the network",,, +993,"Office 2016 / Office 365","Microsoft Excel: Always open untrusted database files in Protected View",,, +309,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",,, +970,"Office 2016 / Office 365","Microsoft Excel: Ask to update automatic links",,, +1779,"Office 2016 / Office 365","Microsoft Excel: Block Excel XLL Add-ins that come from an untrusted source",,, +315,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",,, +972,"Office 2016 / Office 365","Microsoft Excel: Disable AutoRepublish",,, +978,"Office 2016 / Office 365","Microsoft Excel: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +994,"Office 2016 / Office 365","Microsoft Excel: Do not open files from the Internet zone in Protected View",,, +995,"Office 2016 / Office 365","Microsoft Excel: Do not open files in unsafe locations in Protected View",,, +973,"Office 2016 / Office 365","Microsoft Excel: Do not show AutoRepublish warning alert",,, +969,"Office 2016 / Office 365","Microsoft Excel: Do not show data extraction options when opening corrupt workbooks",,, +310,"Office 2016 / Office 365","Microsoft Excel: Don't update links",,, +313,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",,, +312,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",,, +1689,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDEAllowed)",,, +314,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDECleaned)",,, +980,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Dif and Sylk files",,, +981,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 macrosheets and add-in files",,, +982,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 2 worksheets",,, +983,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 macrosheets and add-in files",,, +984,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 3 worksheets",,, +985,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 macrosheets and add-in files",,, +986,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 workbooks",,, +987,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 4 worksheets",,, +988,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95 workbooks",,, +989,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 95-97 workbooks and templates",,, +990,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Excel 97-2003 workbooks and templates",,, +1919,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: File Block includes external link files",,, +991,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Set default file block behavior",,, +992,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: Web pages and Excel 2003 XML spreadsheets",,, +979,"Office 2016 / Office 365","Microsoft Excel: File Block Settings: dBase III / IV files",,, +974,"Office 2016 / Office 365","Microsoft Excel: Force file extension to match file type",,, +971,"Office 2016 / Office 365","Microsoft Excel: Load pictures from Web pages not created in Excel",,, +1660,"Office 2016 / Office 365","Microsoft Excel: Prevent Excel from running XLM macros",,, +1783,"Office 2016 / Office 365","Microsoft Excel: Python Notification Settings",,, +1297,"Office 2016 / Office 365","Microsoft Excel: Require that application add-ins are signed by Trusted Publisher",,, +975,"Office 2016 / Office 365","Microsoft Excel: Scan encrypted macros in Excel Open XML workbooks",,, +997,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Allow edit in Protected View)",,, +996,"Office 2016 / Office 365","Microsoft Excel: Set document behavior if file validation fails (Open in Protected View)",,, +998,"Office 2016 / Office 365","Microsoft Excel: Turn off Protected View for attachments opened from Outlook",,, +976,"Office 2016 / Office 365","Microsoft Excel: Turn off file validation",,, +316,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings",,, +317,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",,, +1870,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1880,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Enable Excel 4.0 macros when VBA macros are enabled",,, +1871,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1299,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +977,"Office 2016 / Office 365","Microsoft Excel: WEBSERVICE Function Notification Settings",,, +318,"Office 2016 / Office 365","Microsoft OneNote: Disable embedded files",,, +1025,"Office 2016 / Office 365","Microsoft Outlook: Allow Active X One Off Forms",,, +1045,"Office 2016 / Office 365","Microsoft Outlook: Allow hyperlinks in suspected phishing e-mail messages",,, +1037,"Office 2016 / Office 365","Microsoft Outlook: Allow scripts in one-off Outlook forms",,, +1033,"Office 2016 / Office 365","Microsoft Outlook: Allow users to demote attachments to Level 2",,, +1019,"Office 2016 / Office 365","Microsoft Outlook: Authentication with Exchange Server",,, +1039,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing an address book",,, +1040,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when accessing the Formula property of a UserProperty object",,, +1041,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when executing Save As",,, +1042,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when reading address information",,, +1043,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when responding to meeting and task requests",,, +1044,"Office 2016 / Office 365","Microsoft Outlook: Configure Outlook object model prompt when sending mail",,, +1034,"Office 2016 / Office 365","Microsoft Outlook: Display Level 1 attachments",,, +1021,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for public folders",,, +1022,"Office 2016 / Office 365","Microsoft Outlook: Do not allow Outlook object model scripts to run for shared folders",,, +1028,"Office 2016 / Office 365","Microsoft Outlook: Do not display 'Publish to GAL' button",,, +1020,"Office 2016 / Office 365","Microsoft Outlook: Enable RPC encryption",,, +1917,"Office 2016 / Office 365","Microsoft Outlook: Folder Home Pages for Outlook Special Folders: Do not allow Home Page URL to be set in folder Properties",,, +1027,"Office 2016 / Office 365","Microsoft Outlook: Include Internet in Safe Zones for Automatic Picture Download",,, +1024,"Office 2016 / Office 365","Microsoft Outlook: Junk E-mail protection level",,, +1029,"Office 2016 / Office 365","Microsoft Outlook: Minimum encryption settings",,, +1032,"Office 2016 / Office 365","Microsoft Outlook: Outlook Security Mode",,, +1918,"Office 2016 / Office 365","Microsoft Outlook: Outlook Today Settings: Outlook Today availability",,, +1026,"Office 2016 / Office 365","Microsoft Outlook: Prevent users from customizing attachment security settings",,, +1035,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 1",,, +1036,"Office 2016 / Office 365","Microsoft Outlook: Remove file extensions blocked as Level 2",,, +1031,"Office 2016 / Office 365","Microsoft Outlook: Retrieving CRLs (Certificate Revocation Lists)",,, +1046,"Office 2016 / Office 365","Microsoft Outlook: Security setting for macros",,, +1038,"Office 2016 / Office 365","Microsoft Outlook: Set Outlook object model custom actions execution prompt",,, +1030,"Office 2016 / Office 365","Microsoft Outlook: Signature Warning",,, +1023,"Office 2016 / Office 365","Microsoft Outlook: Use Unicode format when dragging e-mail message to file system",,, +1058,"Office 2016 / Office 365","Microsoft PowerPoint: Allow Trusted Locations on the network",,, +319,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",,, +1050,"Office 2016 / Office 365","Microsoft PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +1053,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files from the Internet zone in Protected View",,, +1054,"Office 2016 / Office 365","Microsoft PowerPoint: Do not open files in unsafe locations in Protected View",,, +1924,"Office 2016 / Office 365","Microsoft PowerPoint: OLE Active Content",,, +1051,"Office 2016 / Office 365","Microsoft PowerPoint: PowerPoint 97-2003 presentations, shows, templates and add-in files",,, +1298,"Office 2016 / Office 365","Microsoft PowerPoint: Require that application add-ins are signed by Trusted Publisher",,, +1047,"Office 2016 / Office 365","Microsoft PowerPoint: Run Programs",,, +1048,"Office 2016 / Office 365","Microsoft PowerPoint: Scan encrypted macros in PowerPoint Open XML presentations",,, +1052,"Office 2016 / Office 365","Microsoft PowerPoint: Set default file block behavior",,, +1056,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Allow edit in Protected View)",,, +1055,"Office 2016 / Office 365","Microsoft PowerPoint: Set document behavior if file validation fails (Open in Protected View)",,, +1057,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off Protected View for attachments opened from Outlook",,, +1049,"Office 2016 / Office 365","Microsoft PowerPoint: Turn off file validation",,, +320,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",,, +1872,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1873,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1300,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +1059,"Office 2016 / Office 365","Microsoft Project: Allow Trusted Locations on the network",,, +1881,"Office 2016 / Office 365","Microsoft Project: Block macros from running in Office files from the internet",,, +1060,"Office 2016 / Office 365","Microsoft Project: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +1292,"Office 2016 / Office 365","Microsoft Project: Require that application add-ins are signed by Trusted Publisher",,, +1061,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy)",,, +1303,"Office 2016 / Office 365","Microsoft Project: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +1781,"Office 2016 / Office 365","Microsoft Publisher: Block macros from running in Office files from the internet",,, +1063,"Office 2016 / Office 365","Microsoft Publisher: Disable Trust Bar Notification for unsigned application add-ins",,, +1062,"Office 2016 / Office 365","Microsoft Publisher: Publisher Automation Security Level",,, +1293,"Office 2016 / Office 365","Microsoft Publisher: Require that application add-ins are signed by Trusted Publisher",,, +1064,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy)",,, +1874,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1875,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1304,"Office 2016 / Office 365","Microsoft Publisher: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +1065,"Office 2016 / Office 365","Microsoft Visio: Allow Trusted Locations on the network",,, +1066,"Office 2016 / Office 365","Microsoft Visio: Block macros from running in Office files from the Internet",,, +1067,"Office 2016 / Office 365","Microsoft Visio: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +1069,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2000-2002 Binary Drawings, Templates and Stencils",,, +1070,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 2003-2010 Binary Drawings, Templates and Stencils",,, +1071,"Office 2016 / Office 365","Microsoft Visio: File Block Settings: Visio 5.0 or earlier Binary Drawings, Templates and Stencils",,, +1294,"Office 2016 / Office 365","Microsoft Visio: Require that application add-ins are signed by Trusted Publisher",,, +1068,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy)",,, +1876,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1877,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1305,"Office 2016 / Office 365","Microsoft Visio: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +322,"Office 2016 / Office 365","Microsoft Word (Mail): Don't update links",,, +1089,"Office 2016 / Office 365","Microsoft Word: Allow Trusted Locations on the network",,, +323,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",,, +1073,"Office 2016 / Office 365","Microsoft Word: Disable Trust Bar Notification for unsigned application add-ins and block them",,, +1084,"Office 2016 / Office 365","Microsoft Word: Do not open files from the Internet zone in Protected View",,, +1085,"Office 2016 / Office 365","Microsoft Word: Do not open files in unsafe locations in Protected View",,, +321,"Office 2016 / Office 365","Microsoft Word: Don't update links",,, +1295,"Office 2016 / Office 365","Microsoft Word: Dynamic Data Exchange",,, +1075,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Set default file block behavior",,, +1076,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2 and earlier binary documents and templates",,, +1077,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2000 binary documents and templates",,, +1078,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2003 binary documents and templates",,, +1079,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 2007 and later binary documents and templates",,, +1080,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 6.0 binary documents and templates",,, +1081,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 95 binary documents and templates",,, +1082,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word 97 binary documents and templates",,, +1083,"Office 2016 / Office 365","Microsoft Word: File Block Settings: Word XP binary documents and templates",,, +1296,"Office 2016 / Office 365","Microsoft Word: Require that application add-ins are signed by Trusted Publisher",,, +1074,"Office 2016 / Office 365","Microsoft Word: Scan encrypted macros in Word Open XML documents",,, +1087,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Allow edit in Protected View)",,, +1086,"Office 2016 / Office 365","Microsoft Word: Set document behavior if file validation fails (Open in Protected View)",,, +1088,"Office 2016 / Office 365","Microsoft Word: Turn off Protected View for attachments opened from Outlook",,, +1072,"Office 2016 / Office 365","Microsoft Word: Turn off file validation",,, +324,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings",,, +325,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",,, +1878,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Block certificates from trusted publishers that are only installed in the current user certificate store",,, +1879,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require Extended Key Usage (EKU) for certificates from trusted publishers",,, +1301,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy) - Require macros to be signed by a trusted publisher",,, +1284,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Access)",,, +1276,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Excel)",,, +1279,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (OneNote)",,, +1283,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Outlook)",,, +1278,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (PowerPoint)",,, +1281,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Project)",,, +1277,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Publisher)",,, +1280,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Visio)",,, +1282,"Office 2016 / Office 365","Restrict legacy JScript execution for Office (Word)",,, +1009,"Office 2016 / Office 365","Security Settings: ActiveX Control Initialization",,, +1782,"Office 2016 / Office 365","Security Settings: Allow Basic Authentication prompts from network proxies",,, +1285,"Office 2016 / Office 365","Security Settings: Allow VBA to load typelib references by path from untrusted intranet locations",,, +1016,"Office 2016 / Office 365","Security Settings: Allow mix of policy and user locations",,, +1290,"Office 2016 / Office 365","Security Settings: Application Guard: Prevent users from removing Application Guard protection on files",,, +1291,"Office 2016 / Office 365","Security Settings: Application Guard: Turn off protection of unsupported file types in Application Guard for Office",,, +1010,"Office 2016 / Office 365","Security Settings: Automation Security",,, +1920,"Office 2016 / Office 365","Security Settings: Block Insecure Protocols",,, +1921,"Office 2016 / Office 365","Security Settings: Block OLE Graph",,, +1922,"Office 2016 / Office 365","Security Settings: Block OrgChart",,, +1286,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts",,, +1287,"Office 2016 / Office 365","Security Settings: Control how Office handles form-based sign-in prompts (Hosts)",,, +1018,"Office 2016 / Office 365","Security Settings: Disable Smart Document's use of manifests",,, +1288,"Office 2016 / Office 365","Security Settings: Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine",,, +1011,"Office 2016 / Office 365","Security Settings: Disable all Trust Bar notifications for security issues",,, +1017,"Office 2016 / Office 365","Security Settings: Disable the Office client from polling the SharePoint Server for published links",,, +1780,"Office 2016 / Office 365","Security Settings: Encryption mode for Information Rights Management (IRM)",,, +1012,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office 97-2003 files",,, +1013,"Office 2016 / Office 365","Security Settings: Encryption type for password protected Office Open XML files",,, +1014,"Office 2016 / Office 365","Security Settings: Load Controls in Forms3",,, +308,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",,, +1289,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",,, +1015,"Office 2016 / Office 365","Security Settings: Protect document metadata for rights managed Office Open XML Files",,, +1923,"Office 2016 / Office 365","Security Settings: Restrict Apps from FPRPC Fallback",,, +1273,"Office 2016 / Office 365","Skype for Business: Configure SIP security mode",,, +1274,"Office 2016 / Office 365","Skype for Business: Disable HTTP fallback for SIP connection",,, +330,"Office 365","Allow the use of additional optional connected experiences",,, +327,"Office 365","Allow the use of connected experiences in Office",,, +328,"Office 365","Allow the use of connected experiences that analyze content",,, +329,"Office 365","Allow the use of connected experiences that download online content",,, +331,"Office 365","Configure the level of client software diagnostic data sent by Office to Microsoft",,, +326,"Office 365","Disable the Office 365 Telemetry module",,, +1600,"Schannel: TLS Settings: Ciphers","AES 128/128",,, +1601,"Schannel: TLS Settings: Ciphers","AES 256/256",,, +1591,"Schannel: TLS Settings: Ciphers","DES 56/56",,, +1590,"Schannel: TLS Settings: Ciphers",NULL,,, +1594,"Schannel: TLS Settings: Ciphers","RC2 128/128",,, +1592,"Schannel: TLS Settings: Ciphers","RC2 40/128",,, +1593,"Schannel: TLS Settings: Ciphers","RC2 56/128",,, +1598,"Schannel: TLS Settings: Ciphers","RC4 128/128",,, +1595,"Schannel: TLS Settings: Ciphers","RC4 40/128",,, +1596,"Schannel: TLS Settings: Ciphers","RC4 56/128",,, +1597,"Schannel: TLS Settings: Ciphers","RC4 64/128",,, +1599,"Schannel: TLS Settings: Ciphers","Triple DES 168",,, +1603,"Schannel: TLS Settings: Hashes",MD5,,, +1604,"Schannel: TLS Settings: Hashes",SHA-1,,, +1605,"Schannel: TLS Settings: Hashes",SHA-256,,, +1606,"Schannel: TLS Settings: Hashes",SHA-384,,, +1607,"Schannel: TLS Settings: Hashes",SHA-512,,, +1608,"Schannel: TLS Settings: KeyExchangeAlgorithms",Diffie-Hellman,,, +1610,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ClientMinKeyBitLength)",,, +1609,"Schannel: TLS Settings: KeyExchangeAlgorithms","Diffie-Hellman (ServerMinKeyBitLength)",,, +1611,"Schannel: TLS Settings: KeyExchangeAlgorithms",ECDH,,, +1612,"Schannel: TLS Settings: KeyExchangeAlgorithms",PKCS,,, +1613,"Schannel: TLS Settings: KeyExchangeAlgorithms","PKCS (ClientMinKeyBitLength)",,, +1564,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello",,, +1565,"Schannel: TLS Settings: Protocols","Client: Multi-Protocol Unified Hello (Disabledbydefault)",,, +1568,"Schannel: TLS Settings: Protocols","Client: PCT",,, +1569,"Schannel: TLS Settings: Protocols","Client: PCT (Disabledbydefault)",,, +1572,"Schannel: TLS Settings: Protocols","Client: SSLv2.0",,, +1573,"Schannel: TLS Settings: Protocols","Client: SSLv2.0 (Disabledbydefault)",,, +1576,"Schannel: TLS Settings: Protocols","Client: SSLv3.0",,, +1577,"Schannel: TLS Settings: Protocols","Client: SSLv3.0 (Disabledbydefault)",,, +1580,"Schannel: TLS Settings: Protocols","Client: TLSv1.0",,, +1581,"Schannel: TLS Settings: Protocols","Client: TLSv1.0 (Disabledbydefault)",,, +1584,"Schannel: TLS Settings: Protocols","Client: TLSv1.1",,, +1585,"Schannel: TLS Settings: Protocols","Client: TLSv1.1 (Disabledbydefault)",,, +1588,"Schannel: TLS Settings: Protocols","Client: TLSv1.2",,, +1589,"Schannel: TLS Settings: Protocols","Client: TLSv1.2 (Disabledbydefault)",,, +1624,"Schannel: TLS Settings: Protocols","Client: TLSv1.3",,, +1625,"Schannel: TLS Settings: Protocols","Client: TLSv1.3 (Disabledbydefault)",,, +1562,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello",,, +1563,"Schannel: TLS Settings: Protocols","Server: Multi-Protocol Unified Hello (Disabledbydefault)",,, +1566,"Schannel: TLS Settings: Protocols","Server: PCT",,, +1567,"Schannel: TLS Settings: Protocols","Server: PCT (Disabledbydefault)",,, +1570,"Schannel: TLS Settings: Protocols","Server: SSLv2.0",,, +1571,"Schannel: TLS Settings: Protocols","Server: SSLv2.0 (Disabledbydefault)",,, +1574,"Schannel: TLS Settings: Protocols","Server: SSLv3.0",,, +1575,"Schannel: TLS Settings: Protocols","Server: SSLv3.0 (Disabledbydefault)",,, +1578,"Schannel: TLS Settings: Protocols","Server: TLSv1.0",,, +1579,"Schannel: TLS Settings: Protocols","Server: TLSv1.0 (Disabledbydefault)",,, +1582,"Schannel: TLS Settings: Protocols","Server: TLSv1.1",,, +1583,"Schannel: TLS Settings: Protocols","Server: TLSv1.1 (Disabledbydefault)",,, +1586,"Schannel: TLS Settings: Protocols","Server: TLSv1.2",,, +1587,"Schannel: TLS Settings: Protocols","Server: TLSv1.2 (Disabledbydefault)",,, +1622,"Schannel: TLS Settings: Protocols","Server: TLSv1.3",,, +1623,"Schannel: TLS Settings: Protocols","Server: TLSv1.3 (Disabledbydefault)",,, +1714,"Scheduled Task","XblGameSave Standby Task",,, +379,"Security Options","Accounts: Administrator account status",DE,Sicherheitseinstellungen,"Konten: Administratorkontostatus" +765,"Security Options","Accounts: Administrator account status (Member)",,, +12,"Security Options","Accounts: Block Microsoft accounts",DE,Sicherheitseinstellungen,"Konten: Microsoft-Konten blockieren" +380,"Security Options","Accounts: Guest account status",DE,Sicherheitseinstellungen,"Konten: Gastkontenstatus" +766,"Security Options","Accounts: Guest account status (Member)",,, +381,"Security Options","Accounts: Limit local account use of blank passwords to console logon only",DE,Sicherheitseinstellungen,"Konten: Lokale Kontenverwendung von leeren Kennwörtern auf Konsolenanmeldung beschränken" +382,"Security Options","Accounts: Rename administrator account",DE,Sicherheitseinstellungen,"Konten: Administrator umbenennen" +383,"Security Options","Accounts: Rename guest account",DE,Sicherheitseinstellungen,"Konten: Gastkonto umbenennen" +13,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",,, +384,"Security Options","Audit: Shut down system immediately if unable to log security audits",,, +385,"Security Options","Devices: Allowed to format and eject removable media",DE,Sicherheitseinstellungen,"Geräte: Formatieren und Auswerfen von Wechselmedien zulassen" +386,"Security Options","Devices: Prevent users from installing printer drivers",DE,Sicherheitseinstellungen,"Geräte: Anwendern das Installieren von Druckertreibern nicht erlauben" +767,"Security Options","Domain controller: Allow server operators to schedule tasks (DC)",,, +1320,"Security Options","Domain controller: Allow vulnerable Netlogon secure channel connections",,, +961,"Security Options","Domain controller: LDAP server channel binding token requirements",,, +768,"Security Options","Domain controller: LDAP server signing requirements",,, +1867,"Security Options","Domain controller: LDAP server signing requirements Enforcement",,, +769,"Security Options","Domain controller: Refuse machine account password changes (DC)",,, +387,"Security Options","Domain member: Digitally encrypt or sign secure channel data (always)",DE,Sicherheitseinstellungen,"Domänenmitglied: Daten des sicheren Kanals digital verschlüsseln oder signieren (immer)" +388,"Security Options","Domain member: Digitally encrypt secure channel data (when possible)",DE,Sicherheitseinstellungen,"Domänenmitglied: Daten des sicheren Kanals digital verschlüsseln (wenn möglich)" +389,"Security Options","Domain member: Digitally sign secure channel data (when possible)",DE,Sicherheitseinstellungen,"Domänenmitglied: Daten des sicheren Kanals digital signieren (wenn möglich)" +390,"Security Options","Domain member: Disable machine account password changes",DE,Sicherheitseinstellungen,"Domänenmitglied: Änderungen von Computerkontenkennwörtern deaktivieren" +391,"Security Options","Domain member: Maximum machine account password age",DE,Sicherheitseinstellungen,"Domänenmitglied: Maximalalter von Computerkontenkennwörtern" +392,"Security Options","Domain member: Require strong (Windows 2000 or later) session key",DE,Sicherheitseinstellungen,"Domänenmitglied: Starker Sitzungsschlüssel erforderlich (Windows 2000 oder höher)" +14,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Kein STRG+ALT+ENTF erforderlich" +15,"Security Options","Interactive logon: Don't display last signed-in",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Zuletzt angemeldeten Benutzer nicht anzeigen" +16,"Security Options","Interactive logon: Don't display username at sign-in",,, +393,"Security Options","Interactive logon: Machine account lockout threshold",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Schwellenwert für Computerkontosperrung" +394,"Security Options","Interactive logon: Machine inactivity limit",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Inaktivitätsgrenze des Computers" +395,"Security Options","Interactive logon: Message text for users attempting to log on",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Nachricht für Benutzer, die sich anmelden wollen" +396,"Security Options","Interactive logon: Message title for users attempting to log on",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Nachrichtentitel für Benutzer, die sich anmelden wollen" +397,"Security Options","Interactive logon: Number of previous logons to cache (in case domain controller is not available)",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Anzahl zwischenzuspeichernder vorheriger Anmeldungen (für den Fall, dass der Domänencontroller nicht verfügbar ist)" +398,"Security Options","Interactive logon: Prompt user to change password before expiration (Max)",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Anwender vor Ablauf des Kennworts zum Ändern des Kennworts auffordern (Max)" +399,"Security Options","Interactive logon: Prompt user to change password before expiration (Min)",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Anwender vor Ablauf des Kennworts zum Ändern des Kennworts auffordern (Min)" +770,"Security Options","Interactive logon: Require Domain Controller Authentication to unlock workstation (Member)",,, +400,"Security Options","Interactive logon: Smart card removal behavior",DE,Sicherheitseinstellungen,"Interaktive Anmeldung: Verhalten beim Entfernen von Smartcards" +17,"Security Options","Microsoft network client: Digitally sign communications (always)",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Client): Kommunikation digital signieren (immer)" +18,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Client): Kommunikation digital signieren (wenn Server zustimmt)" +401,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Client): Unverschlüsseltes Kennwort an SMB-Server von Drittanbietern senden" +402,"Security Options","Microsoft network server: Amount of idle time required before suspending session",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Server): Leerlaufzeitspanne bis zum Anhalten der Sitzung" +19,"Security Options","Microsoft network server: Digitally sign communications (always)",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Server): Kommunikation digital signieren (immer)" +20,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Server): Kommunikation digital signieren (wenn Client zustimmt)" +403,"Security Options","Microsoft network server: Disconnect clients when logon hours expire",DE,Sicherheitseinstellungen,"Microsoft-Netzwerk (Server): Clientverbindungen trennen, wenn die Anmeldezeit überschritten wird" +404,"Security Options","Microsoft network server: Server SPN target name validation level",DE,Sicherheitseinstellungen,"Microsoft-Netzwerkserver: SPN-Zielnamenüberprüfungsstufe für Server" +771,"Security Options","Microsoft network server: Server SPN target name validation level (Member)",,, +405,"Security Options","Network access: Allow anonymous SID/Name translation",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Anonyme SID-/Namensübersetzung zulassen" +21,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Anonyme Aufzählung von SAM-Konten nicht erlauben" +772,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts (Member)",,, +22,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Anonyme Aufzählung von SAM-Konten und Freigaben nicht erlauben" +773,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares (Member)",,, +23,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Speicherung von Kennwörtern und Anmeldeinformationen für die Netzwerkauthentifizierung nicht zulassen" +406,"Security Options","Network access: Let Everyone permissions apply to anonymous users",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Die Verwendung von ""Jeder""-Berechtigungen für anonyme Benutzer ermöglichen" +407,"Security Options","Network access: Named Pipes that can be accessed anonymously",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Named Pipes, auf die anonym zugegriffen werden kann" +774,"Security Options","Network access: Named Pipes that can be accessed anonymously (DC)",,, +775,"Security Options","Network access: Named Pipes that can be accessed anonymously (Member)",,, +408,"Security Options","Network access: Remotely accessible registry paths",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Registrierungspfade, auf die von anderen Computern aus zugegriffen werden kann" +409,"Security Options","Network access: Remotely accessible registry paths and sub-paths",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Registrierungspfade und -unterpfade, auf die von anderen Computern aus zugegriffen werden kann" +410,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Anonymen Zugriff auf Named Pipes und Freigaben einschränken" +411,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Clients einschränken, die Remoteaufrufe an SAM ausführen dürfen" +776,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM (Member)",,, +412,"Security Options","Network access: Shares that can be accessed anonymously",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Freigaben, auf die anonym zugegriffen werden kann" +413,"Security Options","Network access: Sharing and security model for local accounts",DE,Sicherheitseinstellungen,"Netzwerkzugriff: Modell für gemeinsame Nutzung und Sicherheitsmodell für lokale Konten" +414,"Security Options","Network security: Allow Local System to use computer identity for NTLM",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Lokalem System die Verwendung der Computeridentität für NTLM erlauben" +24,"Security Options","Network security: Allow LocalSystem NULL session fallback",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Zurückgreifen auf NULL-Sitzung für lokales System zulassen" +416,"Security Options","Network security: Allow PKU2U authentication requests to this computer to use online identities",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Lässt an diesen Computer gerichtete PKU2U-Authentifizierungsanforderungen zu, um die Verwendung von Onlineidentitäten zu ermöglichen" +417,"Security Options","Network security: Configure encryption types allowed for Kerberos",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Für Kerberos zulässige Verschlüsselungstypen konfigurieren" +418,"Security Options","Network security: Do not store LAN Manager hash value on next password change",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Keine LAN Manager-Hashwerte für nächste Kennwortänderung speichern" +419,"Security Options","Network security: Force logoff when logon hours expires",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Abmeldung nach Ablauf der Anmeldezeit erzwingen" +25,"Security Options","Network security: LAN Manager authentication level",DE,Sicherheitseinstellungen,"Netzwerksicherheit: LAN Manager-Authentifizierungsebene" +1882,"Security Options","Network security: LDAP client encryption requirements",,, +26,"Security Options","Network security: LDAP client signing requirements",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Signaturanforderungen für LDAP-Clients" +27,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Minimale Sitzungssicherheit für NTLM-SSP-basierte Clients (einschließlich sicherer RPC-Clients)" +28,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Minimale Sitzungssicherheit für NTLM-SSP-basierte Server (einschließlich sicherer RPC-Server)" +29,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",,, +30,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain",,, +1800,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain (DC only)",,, +1558,"Security Options","Network security: Restrict NTLM: Incoming NTLM traffic",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Beschränken von NTLM: Eingehender NTLM-Datenverkehr" +31,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",DE,Sicherheitseinstellungen,"Netzwerksicherheit: Beschränken von NTLM: Ausgehenden NTLM-Datenverkehr zu Remoteservern" +32,"Security Options","Shutdown: Allow system to be shut down without having to log on",,, +420,"Security Options","System cryptography: Force strong key protection for user keys stored on the computer",DE,Sicherheitseinstellungen,"Systemkryptografie: Starken Schlüsselschutz für auf dem Computer gespeicherte Benutzerschlüssel erzwingen" +1321,"Security Options","System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing",,, +421,"Security Options","System objects: Require case insensitivity for non-Windows subsystem",DE,Sicherheitseinstellungen,"Systemobjekte: Groß-/Kleinschreibung für Nicht-Windows-Subsysteme ignorieren" +422,"Security Options","System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)",DE,Sicherheitseinstellungen,"Systemobjekte: Standardberechtigungen interner Systemobjekte (z. B. symbolischer Verknüpfungen) verstärken" +1559,"Security Options","System settings: Optional subsystems",DE,Sicherheitseinstellungen,"Systemeinstellungen: Optionale Subsysteme" +33,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Administratorgenehmigungsmodus für das integrierte Administratorkonto" +1537,"Security Options","User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: UIAccess-Anwendungen können erhöhte Rechte ohne sicheren Desktop anfordern" +34,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Verhalten der Eingabeaufforderung für erhöhte Rechte für Administratoren im Administratorgenehmigungsmodus" +1827,"Security Options","User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection",,, +35,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Verhalten der Eingabeaufforderung für erhöhte Rechte für Standardbenutzer" +1828,"Security Options","User Account Control: Configure type of Admin Approval Mode Admin approval mode",,, +423,"Security Options","User Account Control: Detect application installations and prompt for elevation",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Anwendungsinstallationen erkennen und erhöhte Rechte anfordern" +424,"Security Options","User Account Control: Only elevate UIAccess applications that are installed in secure locations",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Erhöhte Rechte nur für UIAccess-Anwendungen, die an sicheren Orten installiert sind" +425,"Security Options","User Account Control: Run all administrators in Admin Approval Mode",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Alle Administratoren im Administratorgenehmigungsmodus ausführen" +426,"Security Options","User Account Control: Switch to the secure desktop when prompting for elevation",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Bei Benutzeraufforderung für erhöhte Rechte zum sicheren Desktop wechseln" +427,"Security Options","User Account Control: Virtualize file and registry write failures to per-user locations",DE,Sicherheitseinstellungen,"Benutzerkontensteuerung: Datei- und Registrierungsschreibfehler an Einzelbenutzerorte virtualisieren" +428,"System Services","Bluetooth Audio Gateway Service (BTAGService)",DE,Systemdienste,"Bluetooth-Audiogateway-Dienst (BTAGService)" +429,"System Services","Bluetooth Audio Gateway Service (BTAGService) (Service Startup type)",DE,Systemdienste,"Bluetooth-Audiogateway-Dienst (BTAGService) (Dienst Starttyp)" +430,"System Services","Bluetooth Support Service (bthserv)",DE,Systemdienste,"Bluetooth-Unterstützungsdienst (bthserv)" +431,"System Services","Bluetooth Support Service (bthserv) (Service Startup type)",DE,Systemdienste,"Bluetooth-Unterstützungsdienst (bthserv) (Dienst Starttyp)" +432,"System Services","Computer Browser (Browser)",DE,Systemdienste,"Computer Browser (Browser)" +433,"System Services","Computer Browser (Browser) (Service Startup type) (!Check for false positive for service ""bowser""!)",DE,Systemdienste,"Computer Browser (Browser) (Dienst Starttyp) (!Check for false positive for service ""bowser""!)" +1560,"System Services","Diagnostics Tracking Service (DiagTrack)",DE,Systemdienste,"Benutzererfahrung und Telemetrie im verbundenen Modus (DiagTrack)" +1561,"System Services","Diagnostics Tracking Service (DiagTrack) (Service Startup type)",DE,Systemdienste,"Benutzererfahrung und Telemetrie im verbundenen Modus (DiagTrack) (Dienst Starttyp)" +1778,"System Services","Disable mDNS in Dnscache service",,, +434,"System Services","Downloaded Maps Manager (MapsBroker)",DE,Systemdienste,"Manager für heruntergeladene Karten (MapsBroker)" +435,"System Services","Downloaded Maps Manager (MapsBroker) (Service Startup type)",DE,Systemdienste,"Manager für heruntergeladene Karten (MapsBroker) (Dienst Starttyp)" +1885,"System Services","GameInput Service (GameInputSvc)",,, +1886,"System Services","GameInput Service (GameInputSvc) (Service Startup type)",,, +436,"System Services","Geolocation Service (lfsvc)",DE,Systemdienste,"Geolocation-Dienst (lfsvc)" +437,"System Services","Geolocation Service (lfsvc) (Service Startup type)",DE,Systemdienste,"Geolocation-Dienst (lfsvc) (Dienst Starttyp)" +438,"System Services","IIS Admin Service (IISADMIN)",DE,Systemdienste,"IIS Admin Service (IISADMIN)" +439,"System Services","IIS Admin Service (IISADMIN) (Service Startup type)",DE,Systemdienste,"IIS Admin Service (IISADMIN) (Dienst Starttyp)" +440,"System Services","Infrared monitor service (irmon)",DE,Systemdienste,"Infrarotüberwachungsdienst (irmon)" +441,"System Services","Infrared monitor service (irmon) (Service Startup type)",DE,Systemdienste,"Infrarotüberwachungsdienst (irmon) (Dienst Starttyp)" +442,"System Services","Internet Connection Sharing (ICS) (SharedAccess)",DE,Systemdienste,"Gemeinsame Nutzung der Internetverbindung (SharedAccess)" +443,"System Services","Internet Connection Sharing (ICS) (SharedAccess) (Service Startup type)",DE,Systemdienste,"Gemeinsame Nutzung der Internetverbindung (SharedAccess) (Dienst Starttyp)" +444,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc)",DE,Systemdienste,"Verbindungsschicht-Topologieerkennungs-Zuordnungsprogramm (lltdsvc)" +445,"System Services","Link-Layer Topology Discovery Mapper (lltdsvc) (Service Startup type)",DE,Systemdienste,"Verbindungsschicht-Topologieerkennungs-Zuordnungsprogramm (lltdsvc) (Dienst Starttyp)" +446,"System Services","LxssManager (LxssManager)",DE,Systemdienste,"LxssManager (LxssManager)" +447,"System Services","LxssManager (LxssManager) (Service Startup type)",DE,Systemdienste,"LxssManager (LxssManager) (Dienst Starttyp)" +448,"System Services","Microsoft FTP Service (FTPSVC)",DE,Systemdienste,"Microsoft FTP Service (FTPSVC)" +449,"System Services","Microsoft FTP Service (FTPSVC) (Service Startup type)",DE,Systemdienste,"Microsoft FTP Service (FTPSVC) (Dienst Starttyp)" +1315,"System Services","Microsoft Store Install Service (InstallService)",,, +1316,"System Services","Microsoft Store Install Service (InstallService) (Service Startup type)",,, +450,"System Services","Microsoft iSCSI Initiator Service (MSiSCSI)",DE,Systemdienste,"Microsoft iSCSI-Initiator-Dienst (MsiSCSI)" +451,"System Services","Microsoft iSCSI Initiator Service (MsiSCSI) (Service Startup type)",DE,Systemdienste,"Microsoft iSCSI-Initiator-Dienst (MsiSCSI) (Dienst Starttyp)" +452,"System Services","OpenSSH SSH Server (sshd)",DE,Systemdienste,"OpenSSH SSH Server (sshd)" +453,"System Services","OpenSSH SSH Server (sshd) (Service Startup type)",DE,Systemdienste,"OpenSSH SSH Server (sshd) (Dienst Starttyp)" +460,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg)",DE,Systemdienste,"PNRP-Computernamenveröffentlichungs-Dienst (PNRPAutoReg)" +461,"System Services","PNRP Machine Name Publication Service (PNRPAutoReg) (Service Startup type)",DE,Systemdienste,"PNRP-Computernamenveröffentlichungs-Dienst (PNRPAutoReg) (Dienst Starttyp)" +454,"System Services","Peer Name Resolution Protocol (PNRPsvc)",DE,Systemdienste,"Peer Name Resolution-Protokoll (PNRPsvc)" +455,"System Services","Peer Name Resolution Protocol (PNRPsvc) (Service Startup type)",DE,Systemdienste,"Peer Name Resolution-Protokoll (PNRPsvc) (Dienst Starttyp)" +456,"System Services","Peer Networking Grouping (p2psvc)",DE,Systemdienste,"Peernetzwerk-Gruppenzuordnung (p2psvc)" +457,"System Services","Peer Networking Grouping (p2psvc) (Service Startup type)",DE,Systemdienste,"Peernetzwerk-Gruppenzuordnung (p2psvc) (Dienst Starttyp)" +458,"System Services","Peer Networking Identity Manager (p2pimsvc)",DE,Systemdienste,"Peernetzwerkidentitäts-Manager (p2pimsvc)" +459,"System Services","Peer Networking Identity Manager (p2pimsvc) (Service Startup type)",DE,Systemdienste,"Peernetzwerkidentitäts-Manager (p2pimsvc) (Dienst Starttyp)" +1664,"System Services","Print Spooler (Spooler)",,, +1680,"System Services","Print Spooler (Spooler) (DC only) ",,, +1682,"System Services","Print Spooler (Spooler) (MS only)",,, +1665,"System Services","Print Spooler (Spooler) (Service Startup type)",,, +1681,"System Services","Print Spooler (Spooler) (Service Startup type) (DC only) ",,, +1683,"System Services","Print Spooler (Spooler) (Service Startup type) (MS only)",,, +462,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport)",DE,Systemdienste,"Unterstützung in der Systemsteuerung unter Lösungen für Probleme (wercplsupport)" +463,"System Services","Problem Reports and Solutions Control Panel Support (wercplsupport) (Service Startup type)",DE,Systemdienste,"Unterstützung in der Systemsteuerung unter Lösungen für Probleme (wercplsupport) (Dienst Starttyp)" +464,"System Services","Remote Access Auto Connection Manager (RasAuto)",DE,Systemdienste,"Verwaltung für automatische RAS-Verbindung (RasAuto)" +465,"System Services","Remote Access Auto Connection Manager (RasAuto) (Service Startup type)",DE,Systemdienste,"Verwaltung für automatische RAS-Verbindung (RasAuto) (Dienst Starttyp)" +466,"System Services","Remote Desktop Configuration (SessionEnv)",DE,Systemdienste,"Konfiguration für Remotedesktops (SessionEnv)" +467,"System Services","Remote Desktop Configuration (SessionEnv) (Service Startup type)",DE,Systemdienste,"Konfiguration für Remotedesktops (SessionEnv) (Dienst Starttyp)" +468,"System Services","Remote Desktop Services (TermService)",DE,Systemdienste,"Remotedesktopdienste (TermService)" +469,"System Services","Remote Desktop Services (TermService) (Service Startup type)",DE,Systemdienste,"Remotedesktopdienste (TermService) (Dienst Starttyp)" +470,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService)",DE,Systemdienste,"Remote Desktop Services UserMode Port Redirector (UmRdpService)" +471,"System Services","Remote Desktop Services UserMode Port Redirector (UmRdpService) (Service Startup type)",DE,Systemdienste,"Remote Desktop Services UserMode Port Redirector (UmRdpService) (Dienst Starttyp)" +472,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",DE,Systemdienste,"Anschlussumleitung für Remotedesktopdienst im Benutzermodus (UmRdpService)" +472,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator)",DE,Systemdienste,"RPC-Locator (RpcLocator)" +473,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",DE,Systemdienste,"Anschlussumleitung für Remotedesktopdienst im Benutzermodus (UmRdpService) (Dienst Starttyp)" +473,"System Services","Remote Procedure Call (RPC) Locator (RpcLocator) (Service Startup type)",DE,Systemdienste,"RPC-Locator (RpcLocator) (Service Startup type)" +474,"System Services","Remote Registry (RemoteRegistry)",DE,Systemdienste,"Remoteregistrierung (RemoteRegistry)" +475,"System Services","Remote Registry (RemoteRegistry) (Service Startup type)",DE,Systemdienste,"Remoteregistrierung (RemoteRegistry) (Dienst Starttyp)" +476,"System Services","Routing and Remote Access (RemoteAccess)",DE,Systemdienste,"Routing und RAS (RemoteAccess)" +477,"System Services","Routing and Remote Access (RemoteAccess) (Service Startup type)",DE,Systemdienste,"Routing und RAS (RemoteAccess) (Dienst Starttyp)" +482,"System Services","SNMP Service (SNMP)",DE,Systemdienste,"SNMP Service (SNMP)" +483,"System Services","SNMP Service (SNMP) (Service Startup type)",DE,Systemdienste,"SNMP Service (SNMP) (Dienst Starttyp)" +486,"System Services","SSDP Discovery (SSDPSRV)",DE,Systemdienste,"SSDP-Suche (SSDPSRV)" +487,"System Services","SSDP Discovery (SSDPSRV) (Service Startup type)",DE,Systemdienste,"SSDP-Suche (SSDPSRV) (Dienst Starttyp)" +1322,"System Services","Secondary Logon (seclogon)",,, +1323,"System Services","Secondary Logon (seclogon) (Service Startup type)",,, +478,"System Services","Server (LanmanServer)",DE,Systemdienste,"Server (LanmanServer)" +479,"System Services","Server (LanmanServer) (Service Startup type)",DE,Systemdienste,"Server (LanmanServer) (Dienst Starttyp)" +480,"System Services","Simple TCP/IP Services (simptcp)",DE,Systemdienste,"Simple TCP/IP Services (simptcp)" +481,"System Services","Simple TCP/IP Services (simptcp) (Service Startup type)",DE,Systemdienste,"Simple TCP/IP Services (simptcp) (Dienst Starttyp)" +484,"System Services","Special Administration Console Helper (sacsvr)",,, +485,"System Services","Special Administration Console Helper (sacsvr) (Service Startup type)",,, +488,"System Services","UPnP Device Host (upnphost)",DE,Systemdienste,"UPnP-Gerätehost (upnphost)" +489,"System Services","UPnP Device Host (upnphost) (Service Startup type)",DE,Systemdienste,"UPnP-Gerätehost (upnphost) (Dienst Starttyp)" +490,"System Services","Web Management Service (WMSvc)",DE,Systemdienste,"Web Management Service (WMSvc)" +491,"System Services","Web Management Service (WMSvc) (Service Startup type)",DE,Systemdienste,"Web Management Service (WMSvc) (Dienst Starttyp)" +1745,"System Services","WebClient (WebClient)",,, +1746,"System Services","WebClient (WebClient) (Service Startup type)",,, +1883,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)",,, +1884,"System Services","WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Service Startup type)",,, +492,"System Services","Windows Error Reporting Service (WerSvc)",DE,Systemdienste,"Windows-Fehlerberichterstattungsdienst (WerSvc)" +493,"System Services","Windows Error Reporting Service (WerSvc) (Service Startup type)",DE,Systemdienste,"Windows-Fehlerberichterstattungsdienst (WerSvc) (Dienst Starttyp)" +494,"System Services","Windows Event Collector (Wecsvc)",DE,Systemdienste,"Windows-Ereignissammlung (Wecsvc)" +495,"System Services","Windows Event Collector (Wecsvc) (Service Startup type)",DE,Systemdienste,"Windows-Ereignissammlung (Wecsvc) (Dienst Starttyp)" +496,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc)",DE,Systemdienste,"Windows Media Player-Netzwerkfreigabedienst (WMPNetworkSvc)" +497,"System Services","Windows Media Player Network Sharing Service (WMPNetworkSvc) (Service Startup type)",DE,Systemdienste,"Windows Media Player-Netzwerkfreigabedienst (WMPNetworkSvc) (Dienst Starttyp)" +498,"System Services","Windows Mobile Hotspot Service (icssvc)",DE,Systemdienste,"Windows-Dienst für mobile Hotspots (icssvc)" +499,"System Services","Windows Mobile Hotspot Service (icssvc) (Service Startup type)",DE,Systemdienste,"Windows-Dienst für mobile Hotspots (icssvc) (Dienst Starttyp)" +500,"System Services","Windows Push Notifications System Service (WpnService)",DE,Systemdienste,"Windows-Pushbenachrichtigungssystemdienst (WpnService)" +501,"System Services","Windows Push Notifications System Service (WpnService) (Service Startup type)",DE,Systemdienste,"Windows-Pushbenachrichtigungssystemdienst (WpnService) (Dienst Starttyp)" +502,"System Services","Windows PushToInstall Service (PushToInstall)",DE,Systemdienste,"Windows PushToInstall-Dienst (PushToInstall)" +503,"System Services","Windows PushToInstall Service (PushToInstall) (Service Startup type)",DE,Systemdienste,"Windows PushToInstall-Dienst (PushToInstall) (Dienst Starttyp)" +504,"System Services","Windows Remote Management (WS-Management) (WinRM)",DE,Systemdienste,"Windows-Remoteverwaltung (WS-Verwaltung) (WinRM)" +505,"System Services","Windows Remote Management (WS-Management) (WinRM) (Service Startup type)",DE,Systemdienste,"Windows-Remoteverwaltung (WS-Verwaltung) (WinRM) (Dienst Starttyp)" +506,"System Services","World Wide Web Publishing Service (W3SVC)",DE,Systemdienste,"World Wide Web Publishing Service (W3SVC)" +507,"System Services","World Wide Web Publishing Service (W3SVC) (Service Startup type)",DE,Systemdienste,"World Wide Web Publishing Service (W3SVC) (Dienst Starttyp)" +508,"System Services","Xbox Accessory Management Service (XboxGipSvc)",DE,Systemdienste,"Xbox Accessory Management Service (XboxGipSvc)" +509,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",DE,Systemdienste,"Xbox Accessory Management Service (XboxGipSvc) (Dienst Starttyp)" +510,"System Services","Xbox Live Auth Manager (XblAuthManager)",DE,Systemdienste,"Xbox Live Authentifizierungs-Manager (XblAuthManager)" +511,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",DE,Systemdienste,"Xbox Live Authentifizierungs-Manager (XblAuthManager) (Dienst Starttyp)" +512,"System Services","Xbox Live Game Save (XblGameSave)",DE,Systemdienste,"Xbox Live-Spiele speichern (XblGameSave)" +513,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",DE,Systemdienste,"Xbox Live-Spiele speichern (XblGameSave) (Dienst Starttyp)" +514,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",DE,Systemdienste,"Xbox Live-Netzwerkservice (XboxNetApiSvc)" +515,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",DE,Systemdienste,"Xbox Live-Netzwerkservice (XboxNetApiSvc) (Dienst Starttyp)" +345,"User Rights Assignment","Access Credential Manager as a trusted caller",DE,"Zuweisen von Benutzerrechten","Auf Anmeldeinformations-Manager als vertrauenswürdigem Aufrufer zugreifen" +5,"User Rights Assignment","Access this computer from the network",DE,"Zuweisen von Benutzerrechten","Auf diesen Computer vom Netzwerk aus zugreifen" +745,"User Rights Assignment","Access this computer from the network (DC)",,, +746,"User Rights Assignment","Access this computer from the network (Member)",,, +346,"User Rights Assignment","Act as part of the operating system",DE,"Zuweisen von Benutzerrechten","Einsetzen als Teil des Betriebssystems" +747,"User Rights Assignment","Add workstations to domain (DC)",,, +347,"User Rights Assignment","Adjust memory quotas for a process",DE,"Zuweisen von Benutzerrechten","Anpassen von Speicherkontigenten für einen Prozess" +6,"User Rights Assignment","Allow log on locally",DE,"Zuweisen von Benutzerrechten","Lokal anmelden zulassen" +1799,"User Rights Assignment","Allow log on locally (DC only)",,, +348,"User Rights Assignment","Allow log on through Remote Desktop Services",DE,"Zuweisen von Benutzerrechten","Anmelden über Remotedesktopdienste zulassen" +748,"User Rights Assignment","Allow log on through Remote Desktop Services (DC)",,, +749,"User Rights Assignment","Allow log on through Remote Desktop Services (Member)",,, +349,"User Rights Assignment","Back up files and directories",DE,"Zuweisen von Benutzerrechten","Sichern von Dateien und Verzeichnissen" +350,"User Rights Assignment","Change the system time",DE,"Zuweisen von Benutzerrechten","Ändern der Systemzeit" +351,"User Rights Assignment","Change the time zone",DE,"Zuweisen von Benutzerrechten","Ändern der Zeitzone" +352,"User Rights Assignment","Create a pagefile",DE,"Zuweisen von Benutzerrechten","Erstellen einer Auslagerungsdatei" +353,"User Rights Assignment","Create a token object",DE,"Zuweisen von Benutzerrechten","Erstellen eines Tokenobjekts" +354,"User Rights Assignment","Create global objects",DE,"Zuweisen von Benutzerrechten","Erstellen globaler Objekte" +355,"User Rights Assignment","Create permanent shared objects",DE,"Zuweisen von Benutzerrechten","Erstellen von dauerhaft freigegebenen Objekten" +356,"User Rights Assignment","Create symbolic links",DE,"Zuweisen von Benutzerrechten","Erstellen symbolischer Verknüpfungen" +750,"User Rights Assignment","Create symbolic links (DC)",,, +357,"User Rights Assignment","Create symbolic links (Hyper-V)",,, +751,"User Rights Assignment","Create symbolic links (Member)",,, +752,"User Rights Assignment","Create symbolic links (Member, Hyper-V)",,, +7,"User Rights Assignment","Debug programs",DE,"Zuweisen von Benutzerrechten","Debuggen von Programmen" +8,"User Rights Assignment","Deny access to this computer from the network",DE,"Zuweisen von Benutzerrechten","Zugriff vom Netzwerk auf diesen Computer verweigern" +753,"User Rights Assignment","Deny access to this computer from the network (DC)",,, +754,"User Rights Assignment","Deny access to this computer from the network (Member)",,, +9,"User Rights Assignment","Deny log on as a batch job",DE,"Zuweisen von Benutzerrechten","Anmelden als Batchauftrag verweigern" +10,"User Rights Assignment","Deny log on as a service",DE,"Zuweisen von Benutzerrechten","Anmelden als Dienst verweigern" +358,"User Rights Assignment","Deny log on locally",DE,"Zuweisen von Benutzerrechten","Lokal anmelden verweigern" +11,"User Rights Assignment","Deny log on through Remote Desktop Services",DE,"Zuweisen von Benutzerrechten","Anmelden über Remotedesktopdienste verweigern" +755,"User Rights Assignment","Deny log on through Remote Desktop Services (DC)",,, +756,"User Rights Assignment","Deny log on through Remote Desktop Services (Member)",,, +359,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation",DE,"Zuweisen von Benutzerrechten","Ermöglichen, dass Computer- und Benutzerkonten für Delegierungszwecke vertraut wird" +757,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (DC)",,, +758,"User Rights Assignment","Enable computer and user accounts to be trusted for delegation (Member)",,, +360,"User Rights Assignment","Force shutdown from a remote system",DE,"Zuweisen von Benutzerrechten","Erzwingen des Herunterfahrens von einem Remotesystem aus" +361,"User Rights Assignment","Generate security audits",DE,"Zuweisen von Benutzerrechten","Generieren von Sicherheitsüberwachungen" +362,"User Rights Assignment","Impersonate a client after authentication",DE,"Zuweisen von Benutzerrechten","Annehmen der Clientidentität nach Authentifizierung" +759,"User Rights Assignment","Impersonate a client after authentication (DC)",,, +760,"User Rights Assignment","Impersonate a client after authentication (Member)",,, +363,"User Rights Assignment","Increase scheduling priority",DE,"Zuweisen von Benutzerrechten","Anheben der Zeitplanungspriorität" +364,"User Rights Assignment","Load and unload device drivers",DE,"Zuweisen von Benutzerrechten","Laden und Entfernen von Gerätetreibern" +365,"User Rights Assignment","Lock pages in memory",DE,"Zuweisen von Benutzerrechten","Sperren von Seiten im Speicher" +366,"User Rights Assignment","Log on as a batch job",DE,"Zuweisen von Benutzerrechten","Anmelden als Stapelverarbeitungsauftrag" +761,"User Rights Assignment","Log on as a batch job (DC)",,, +367,"User Rights Assignment","Log on as a service",DE,"Zuweisen von Benutzerrechten","Anmelden als Dienst" +368,"User Rights Assignment","Log on as a service (Hyper-V)",DE,"Zuweisen von Benutzerrechten","Anmelden als Dienst (Hyper-V)" +1804,"User Rights Assignment","Log on as a service (Windows Defender Application Guard)",,, +369,"User Rights Assignment","Manage auditing and security log",DE,"Zuweisen von Benutzerrechten","Verwalten von Überwachungs- und Sicherheitsprotokollen" +763,"User Rights Assignment","Manage auditing and security log (DC and Exchange)",,, +762,"User Rights Assignment","Manage auditing and security log (DC)",,, +764,"User Rights Assignment","Manage auditing and security log (Member)",,, +370,"User Rights Assignment","Modify an object label",DE,"Zuweisen von Benutzerrechten","Verändern einer Objektbezeichnung" +371,"User Rights Assignment","Modify firmware environment values",DE,"Zuweisen von Benutzerrechten","Verändern der Firmwareumgebungsvariablen" +372,"User Rights Assignment","Perform volume maintenance tasks",DE,"Zuweisen von Benutzerrechten","Durchführen von Volumewartungsaufgaben" +373,"User Rights Assignment","Profile single process",DE,"Zuweisen von Benutzerrechten","Erstellen eines Profils für einen Einzelprozess" +374,"User Rights Assignment","Profile system performance",DE,"Zuweisen von Benutzerrechten","Erstellen eines Profils der Systemleistung" +375,"User Rights Assignment","Replace a process level token",DE,"Zuweisen von Benutzerrechten","Ersetzen eines Tokens auf Prozessebene" +376,"User Rights Assignment","Restore files and directories",DE,"Zuweisen von Benutzerrechten","Wiederherstellen von Dateien und Verzeichnissen" +377,"User Rights Assignment","Shut down the system",DE,"Zuweisen von Benutzerrechten","Herunterfahren des Systems" +800,"User Rights Assignment","Synchronize directory service data (DC)",,, +378,"User Rights Assignment","Take ownership of files or other objects",DE,"Zuweisen von Benutzerrechten","Übernehmen des Besitzes von Dateien und Objekten" +522,"Windows Firewall","Apply local connection security rules (Public Profile, Policy)",DE,"Windows Firewall","Lokale Verbindungssicherheitsregeln anwenden (Öffentliches Profil, Richtlinie)" +521,"Windows Firewall","Apply local firewall rules (Public Profile, Policy)",DE,"Windows Firewall","Lokale Firewallregeln anwenden (Öffentliches Profil, Richtlinie)" +816,"Windows Firewall","Display a notification (Domain Profile)",,, +516,"Windows Firewall","Display a notification (Domain Profile, Policy)",DE,"Windows Firewall","Benachrichtigung anzeigen (Domänenprofil, Richtline)" +817,"Windows Firewall","Display a notification (Private Profile)",,, +518,"Windows Firewall","Display a notification (Private Profile, Policy)",DE,"Windows Firewall","Benachrichtigung anzeigen (Privates Profil, Richtlinie)" +818,"Windows Firewall","Display a notification (Public Profile)",,, +520,"Windows Firewall","Display a notification (Public Profile, Policy)",DE,"Windows Firewall","Benachrichtigung anzeigen (Öffentliches Profil, Richtlinie)" +37,"Windows Firewall","EnableFirewall (Domain Profile)",,, +36,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",DE,"Windows Firewall","Firewallstatus (Domänenprofil, Richtline)" +49,"Windows Firewall","EnableFirewall (Private Profile)",,, +48,"Windows Firewall","EnableFirewall (Private Profile, Policy)",DE,"Windows Firewall","Firewallstatus (Privates Profil, Richtlinie)" +61,"Windows Firewall","EnableFirewall (Public Profile)",,, +60,"Windows Firewall","EnableFirewall (Public Profile, Policy)",DE,"Windows Firewall","Firewallstatus (Öffentliches Profil, Richtlinie)" +294,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x64,,, +295,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x86,,, +275,"Windows Firewall",HardeningKitty-Block-TCP-NetBIOS,,, +276,"Windows Firewall",HardeningKitty-Block-TCP-RDP,,, +277,"Windows Firewall",HardeningKitty-Block-TCP-RPC,,, +278,"Windows Firewall",HardeningKitty-Block-TCP-SMB,,, +279,"Windows Firewall",HardeningKitty-Block-TCP-WinRM,,, +280,"Windows Firewall",HardeningKitty-Block-UDP-NetBIOS,,, +281,"Windows Firewall",HardeningKitty-Block-UDP-RPC,,, +282,"Windows Firewall",HardeningKitty-Block-calc-x64,,, +283,"Windows Firewall",HardeningKitty-Block-calc-x86,,, +284,"Windows Firewall",HardeningKitty-Block-certutil-x64,,, +285,"Windows Firewall",HardeningKitty-Block-certutil-x86,,, +286,"Windows Firewall",HardeningKitty-Block-conhost-x64,,, +287,"Windows Firewall",HardeningKitty-Block-conhost-x86,,, +288,"Windows Firewall",HardeningKitty-Block-cscript-x64,,, +289,"Windows Firewall",HardeningKitty-Block-cscript-x86,,, +290,"Windows Firewall",HardeningKitty-Block-mshta-x64,,, +291,"Windows Firewall",HardeningKitty-Block-mshta-x86,,, +292,"Windows Firewall",HardeningKitty-Block-notepad-x64,,, +293,"Windows Firewall",HardeningKitty-Block-notepad-x86,,, +296,"Windows Firewall",HardeningKitty-Block-wscript-x64,,, +297,"Windows Firewall",HardeningKitty-Block-wscript-x86,,, +39,"Windows Firewall","Inbound Connections (Domain Profile)",,, +38,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",DE,"Windows Firewall","Eingehende Verbindungen (Domänenprofil, Richtline)" +51,"Windows Firewall","Inbound Connections (Private Profile)",,, +50,"Windows Firewall","Inbound Connections (Private Profile, Policy)",DE,"Windows Firewall","Eingehende Verbindungen (Privates Profil, Richtlinie)" +63,"Windows Firewall","Inbound Connections (Public Profile)",,, +62,"Windows Firewall","Inbound Connections (Public Profile, Policy)",DE,"Windows Firewall","Eingehende Verbindungen (Öffentliches Profil, Richtlinie)" +45,"Windows Firewall","Log dropped packets (Domain Profile)",,, +44,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",,, +57,"Windows Firewall","Log dropped packets (Private Profile)",,, +56,"Windows Firewall","Log dropped packets (Private Profile, Policy)",,, +69,"Windows Firewall","Log dropped packets (Public Profile)",,, +68,"Windows Firewall","Log dropped packets (Public Profile, Policy)",,, +43,"Windows Firewall","Log size limit (Domain Profile)",,, +42,"Windows Firewall","Log size limit (Domain Profile, Policy)",,, +55,"Windows Firewall","Log size limit (Private Profile)",,, +54,"Windows Firewall","Log size limit (Private Profile, Policy)",,, +67,"Windows Firewall","Log size limit (Public Profile)",,, +66,"Windows Firewall","Log size limit (Public Profile, Policy)",,, +47,"Windows Firewall","Log successful connections (Domain Profile)",,, +46,"Windows Firewall","Log successful connections (Domain Profile, Policy)",,, +59,"Windows Firewall","Log successful connections (Private Profile)",,, +58,"Windows Firewall","Log successful connections (Private Profile, Policy)",,, +71,"Windows Firewall","Log successful connections (Public Profile)",,, +70,"Windows Firewall","Log successful connections (Public Profile, Policy)",,, +517,"Windows Firewall","Name of log file (Domain Profile, Policy)",,, +519,"Windows Firewall","Name of log file (Private Profile, Policy)",,, +523,"Windows Firewall","Name of log file (Public Profile, Policy)",,, +41,"Windows Firewall","Outbound Connections (Domain Profile)",,, +40,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",DE,"Windows Firewall","Ausgehende Verbindungen (Domain Profile, Policy)" +53,"Windows Firewall","Outbound Connections (Private Profile)",,, +52,"Windows Firewall","Outbound Connections (Private Profile, Policy)",DE,"Windows Firewall","Ausgehende Verbindungen (Private Profile, Policy)" +52,"Windows Firewall","Outbound Connections (Private Profile, Policy)",DE,"Windows Firewall","Ausgehende Verbindungen (Privates Profil, Richtlinie)" +65,"Windows Firewall","Outbound Connections (Public Profile)",,, +64,"Windows Firewall","Outbound Connections (Public Profile, Policy)",,, +337,"Windows Settings","Devices: AutoPlay: Use AutoPlay for all media and devices",,, +336,"Windows Settings","Devices: Typing: Autocorrect misspelled words",,, +333,"Windows Settings","System: Notification & actions: Get tips, tricks, and suggestions as you use Windows",,, +332,"Windows Settings","System: Notification & actions: Show me the Windows welcome experience after updates and occasionally when I sign in to highlight what's new and suggested",,, +334,"Windows Settings","System: Shared experiences: Shared across devices 1",,, +335,"Windows Settings","System: Shared experiences: Shared across devices 2",,, diff --git a/vendor/lists/hardeningkitty_lists_manifest.psd1 b/vendor/lists/hardeningkitty_lists_manifest.psd1 new file mode 100644 index 0000000..b2ed6f0 --- /dev/null +++ b/vendor/lists/hardeningkitty_lists_manifest.psd1 @@ -0,0 +1,144 @@ +@{ + Version = 1 + Algorithm = 'SHA256' + Lists = @{ + 'finding_list_0x6d69636b_machine.csv' = 'CC6CF409C7CB0F7DC0CAEB82B8323DCC13DDB4DCB88E35E9E2CC4F52874816F4' + 'finding_list_0x6d69636b_user.csv' = 'C8CF8A5A7B46E4F94D7B57601732A2359651C878E93AD95B3CF8684D0887A2D5' + 'finding_list_4d5a_machine.csv' = 'D20D7DFBCA7F7100FE5CB639A125AEAFE163503E7B5856DA0308175F1DD15663' + 'finding_list_bsi_sisyphus_windows_10_hd_machine.csv' = 'E1E554DF8F04513CA288B526FBBAD557EA58976197D31F13658E7EBE9BCBF146' + 'finding_list_bsi_sisyphus_windows_10_hd_user.csv' = '063F7684D3BAD43C6221F7193FCA1EFBD59A92E5A30B08818361F9D03A41ECE6' + 'finding_list_bsi_sisyphus_windows_10_nd_machine.csv' = '3117404F5081A907671B5B6A0F5F06CD5E161C131355F3DF7220736051B0DA5D' + 'finding_list_bsi_sisyphus_windows_10_nd_user.csv' = 'FAB458BF91A38CBE5F57212C370C4154874884492389D2E92C8D238651CD9488' + 'finding_list_bsi_sisyphus_windows_10_ne_machine.csv' = '705EFF0788457402919BA967095259B922559C6D1FF17F94C866C45428CC9526' + 'finding_list_bsi_sisyphus_windows_10_ne_user.csv' = 'FAB458BF91A38CBE5F57212C370C4154874884492389D2E92C8D238651CD9488' + 'finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv' = 'BB5A8B9F0BAD5D81E926071A93CE965BEDA1BB1C4CB7727C7823744DA3071A8A' + 'finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv' = 'A0749EABE753A7E85B6DA5AE0E816EACB388596ABF8F637A1E0C5B8E138CE16B' + 'finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv' = '4557143F380B475BCB3E5118B8F49C039C12BA2C144F7B48CF6202A861EEDC63' + 'finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv' = 'A0749EABE753A7E85B6DA5AE0E816EACB388596ABF8F637A1E0C5B8E138CE16B' + 'finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv' = '4557143F380B475BCB3E5118B8F49C039C12BA2C144F7B48CF6202A861EEDC63' + 'finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv' = 'A0749EABE753A7E85B6DA5AE0E816EACB388596ABF8F637A1E0C5B8E138CE16B' + 'finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv' = '94E42738F1083D618C9D762BD08C44465A03B68D2E5893D038ABEAED2D2B821F' + 'finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv' = 'B2C67D9EE3B08DB0825A01844035825A6B16529395BB12E8B8AB4B65A4395FB8' + 'finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv' = 'DDABD3FAFBE87AF595613E051381FC3071F1488615F416DEEADDB7C12E416ED2' + 'finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv' = '4C77315F79E51214306C70591D02B742515B43484820FE14C61DDF7942B98A2B' + 'finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv' = 'D2FCA2CC80C0139D10177B0568D8D9BCCAFC3EF4FA2D978D5809111B3B47CC0D' + 'finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv' = '4C77315F79E51214306C70591D02B742515B43484820FE14C61DDF7942B98A2B' + 'finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv' = 'C4808ACA88037AAC3076863CA24099CD52E41C1A3F672947F33E3CAF10F083B0' + 'finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv' = 'CEC62F77EB39AE43FBE8B19AD5EE8242CF53B514735ADC6B41EEDD15FD3BAFEE' + 'finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv' = '5FC9546F9A2CD7894AEE0D3C80F483CED5E032CC8800082A1D9F15B793BB02C1' + 'finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv' = '98DE51338225E35821E2EC63CADDF9E8493662A507C818588AB37D7FB8F5A302' + 'finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv' = 'D29C3FD8C788A5A59ECCF8ED2E15E8E3756431F70AA787B352DA80FE124B0D98' + 'finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv' = 'D3D8E3DF310719FB3F006A933FECDA4F35A6EC4C22EACD6EECF29986ED232254' + 'finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv' = 'C4808ACA88037AAC3076863CA24099CD52E41C1A3F672947F33E3CAF10F083B0' + 'finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv' = 'CEC62F77EB39AE43FBE8B19AD5EE8242CF53B514735ADC6B41EEDD15FD3BAFEE' + 'finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv' = '9B94DF97AE465A6849B0A25F1E1DA857422CF7A20584E296F2CEF761C1EF66CA' + 'finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv' = 'AF2DF99E7A4B65F921B11B71623FBA3E2B9F2E8EB21E0F34D24040E958734047' + 'finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv' = 'ED249BCA62F1A6A71ADDFE4B2EDF9A23E748E0C083F4ED7E99F35EB6562C6A81' + 'finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv' = '7263DA359D9AEF3FFA6B7398CDF0EC87233BEDD29D867A0A50DCC1E21DF110D8' + 'finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv' = '5B9E83822A3AA9526B2BFD2BF56D046ACCC743BF5A45A89332EBEA9F93DB1003' + 'finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv' = '02779EA283EF5DDF18CFEB14A05FBB244604E7C042E96B1839DAD6B92411A563' + 'finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv' = 'AB6757A924E54116EE1B22C11F1A0FDB5B0B053ACC16096551198CE837A0F181' + 'finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv' = '3C07ACB7B8D32444C02A36B1AF31A13E8757B7BC9522CFEB815E7A1B41D51520' + 'finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv' = '2778978B81286378F11834F6AB4384BDFCA4023EB89767BFAEA21427013B8B59' + 'finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv' = '1E7A9302AC4361B1EC54EBB66AAF121257D39A6D44B6905CCB4CEA5DE93BD8FB' + 'finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv' = '1D23A4BC44936FE3B94FAA50FFC5245DCE9726B502CB6331497FFCD0998704CB' + 'finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv' = '420893D86C78C76F07FC346C3224475AE84B873450274E75692E91E936E4A9B6' + 'finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv' = '8D891F2A16A930C604F4C1D606CDED73A233F27B2ED518CB1BC4F553ECF241F8' + 'finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv' = '10221953C22731FBB5CC96C11CCE27E36C96C07C6E55D899D7506DADD0E2F17C' + 'finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv' = 'CE8AA8166ED28ECE859A5FE8567C649831322057AB6B1DE52AAB7B54B15871FB' + 'finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv' = 'A0749EABE753A7E85B6DA5AE0E816EACB388596ABF8F637A1E0C5B8E138CE16B' + 'finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv' = '7B9A195D4FF36BC7FBDB9BDF261180787E10812FD9516E0F11487E4C4431880B' + 'finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv' = '612A035A6A6E6FD612F2C96D623318B458B446EA608A983DD7B8BEE0934A1BD0' + 'finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv' = 'E23D2E810FC9FBE09886F56E96E8789FD239C7400F681CA13CE829C691A28BC9' + 'finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv' = '98DE51338225E35821E2EC63CADDF9E8493662A507C818588AB37D7FB8F5A302' + 'finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv' = 'A6C4F1E520C40CB3538B11B4C7A2A9524B3C704D989FFE899A25A8D35521A0C8' + 'finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv' = 'D3D8E3DF310719FB3F006A933FECDA4F35A6EC4C22EACD6EECF29986ED232254' + 'finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv' = 'D45A797DFDD6E57B2D4D89F3EBF7968C3394B015108ADE945E1B38714CED9C04' + 'finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv' = 'A0749EABE753A7E85B6DA5AE0E816EACB388596ABF8F637A1E0C5B8E138CE16B' + 'finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv' = '5A118146523C2D0B8C444AF901554F179E46954865C4C5B115F4B16D2996CB1F' + 'finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv' = '612A035A6A6E6FD612F2C96D623318B458B446EA608A983DD7B8BEE0934A1BD0' + 'finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv' = '27004CA663CB422C915610F833C23B79D8F8F4AE1EF33F960C53804D125FD2BF' + 'finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv' = '98DE51338225E35821E2EC63CADDF9E8493662A507C818588AB37D7FB8F5A302' + 'finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv' = 'BF8E4F821DCEF989AF9A0189ED9C91E6903B3A80F6F4D0340A8D84E05E36013F' + 'finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv' = 'D3D8E3DF310719FB3F006A933FECDA4F35A6EC4C22EACD6EECF29986ED232254' + 'finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv' = '8C00CAC3A709782EE1CED106DF9D896A6AF3DF1ADC27745E39D6668A648594F4' + 'finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv' = 'CEC62F77EB39AE43FBE8B19AD5EE8242CF53B514735ADC6B41EEDD15FD3BAFEE' + 'finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv' = '1E1687757AA2339BE955F0D12CA8F2C2514EDE560EBF143D40FF97B3836D8CD4' + 'finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv' = '98DE51338225E35821E2EC63CADDF9E8493662A507C818588AB37D7FB8F5A302' + 'finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv' = 'BD1C6F58970885272175AFE678C1DC95A9391E6DDF6B408A106199410143029E' + 'finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv' = '99BC6878F443F1B81A64171068EF3534AFE32D636A7C4BEAB9A6726EAD826681' + 'finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv' = '45DC9010FD9BAD2B28E2645C07476D838758D2554D5618BE8FD906A588EA844C' + 'finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv' = '220FBFCFBBCD1AB1910DC689A1A4300DC1C4C2D3ED442B9F8F54CBE6B39E012D' + 'finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv' = '0C272B427B01A5ECBEB95CBE764E3AD20D1DFCB3E299CE2DD9D72468BC7C368B' + 'finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv' = '0A2C8354F8C4578F0925A598B1BC855A29FB54458B2465F7E174AB064DF9402B' + 'finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv' = '59A106A408CC7DB4A46DB87F119EC001B28E27816D5C93CCE40AF68892EAC122' + 'finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv' = 'C8433C698D6F6E08C67D5A36657F23D21369595084DAFF15A4BB2BC9F75CCA07' + 'finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv' = '6258CCFDEBDF18D68A300683CF8B68A57A1C6C98FAC5E796E2F7200F1AC020CF' + 'finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv' = 'AA3B8F180BFEEDCC690F427FD0756292019F9D991D4F6B06E09371C718A0AF07' + 'finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv' = '6B2DD93BAC5391EC14AB1BAC2BBD82F01BC2AF5DB8F3139359469C4591D852A3' + 'finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv' = 'AA3B8F180BFEEDCC690F427FD0756292019F9D991D4F6B06E09371C718A0AF07' + 'finding_list_dod_windows_defender_antivirus_stig_v2r1.csv' = '00FDFBEFC9AC9D00A984D06E2B4C28DDB600852441D82F6F3C875F3C39E5D1B7' + 'finding_list_dod_windows_firewall_stig_v1r7.csv' = '82438B3773D7DE069CC1E8BF2831DF2E678F5D1BDE96B31145ACB420F213A9DA' + 'finding_list_intune.csv' = '301CDE82E178ABDABC4A4F070B8513964A5ABB06DEAC2D719373A6EC41D2707D' + 'finding_list_microsoft_windows_tls.csv' = 'E2A4FC5EA430764131FC1F2F7BEF370BC77C140FC9540E87A630814B55A76D15' + 'finding_list_microsoft_windows_tls_future.csv' = 'F777F353AE37D1BE4DE6529B2EB53F45E89CE7283EDA2BD020CED4CC65E6C68E' + 'finding_list_msft_security_baseline_edge_107_machine.csv' = '2FFBA25AE476FD3890038E05E48AD85242442EE826AF658071157266BAE204BB' + 'finding_list_msft_security_baseline_edge_112_machine.csv' = '933FC26792625C7AD345C54FC42607A008CC9B199B7DD5F915A42295AB399251' + 'finding_list_msft_security_baseline_edge_114_machine.csv' = '956F68D455DD40EB9AAE625DF61D6512471E4C99D22A7E39B37708C2C3BB0C87' + 'finding_list_msft_security_baseline_edge_117_machine.csv' = '1DC3BE1F589082B1E212B08A05F20DE2897F8BFD92914BD1A6CA7D5B53447BAC' + 'finding_list_msft_security_baseline_edge_128_machine.csv' = 'A5580C2C1F970C46FF6CA92EC64E81FA49CD301F98C12C2B3053132DE06F0B2E' + 'finding_list_msft_security_baseline_edge_139_machine.csv' = '4F6354DB6F1FE005359EA5E6EA3F6D871664CAA538F8F9BB5DA9403BC9DB3E2A' + 'finding_list_msft_security_baseline_edge_151_machine.csv' = 'A4C624DFCB1A8C3702AE00E84BC51496B661A51178577DE1F1B6F02CDF10A782' + 'finding_list_msft_security_baseline_edge_87_machine.csv' = 'AD47B85960A61EED3EA25496FE473FAE2BD241BCF25A7DA0EA6CAABABA2C2279' + 'finding_list_msft_security_baseline_edge_88_machine.csv' = '9B2DF280EEA330EFE6AB6C6C9CCF60A75F47D489A4E1FAFDEFAA5215DE7CBF4B' + 'finding_list_msft_security_baseline_edge_92_machine.csv' = '462E950F688BCC23AD46C0FB39CA138B616A7CF4A3F024213C4F86ECE39D235F' + 'finding_list_msft_security_baseline_edge_93_machine.csv' = '8BB5B5C0812724A870ABB7E51D0FE27956781348DAB480B4BC4521EA474C2B6B' + 'finding_list_msft_security_baseline_edge_95_machine.csv' = '7D9E83A13E6D348A9F02AE985D3299462EC5A83C10B7D0FCC8F13FDBBBFC43FF' + 'finding_list_msft_security_baseline_edge_96_machine.csv' = '9EC876D2841DAF216DACAC4001DDFB820EFBF69A69835B4D197531ED67FF601F' + 'finding_list_msft_security_baseline_edge_97_machine.csv' = 'B2A0A3A5175E8D09586D1BBCFDA986E43CD4FE999D8AF44B8B5E1513CE393CEF' + 'finding_list_msft_security_baseline_edge_98_machine.csv' = '95088AE545A08536A9165D463A9248C4AF2FFFB68CA8B0006D97F039BA5DA782' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv' = 'BC1E668906F6655C01227EC439E85AF7F5327352E6A4EAFE5647374D5F35AAFE' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv' = '6E6D998A0A9E790A0C645C6AC43EB1516BF9FFB4E7EC06D884D14D3014B475EB' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv' = '3D370943060DBF3F58789F3CBC9524277778F26839ED5C5DE5832E0B7EACF7D8' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv' = '8AD1C68511B809FB71D5D23DE62A90FE81254F4D72F261A16112083CF98D46EB' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv' = '3D370943060DBF3F58789F3CBC9524277778F26839ED5C5DE5832E0B7EACF7D8' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv' = 'C991FCFC1BD3CECE4E7A2B89EEC450BFFCF75DB1B199E4FAF07AC0FD64E80D47' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv' = '3D370943060DBF3F58789F3CBC9524277778F26839ED5C5DE5832E0B7EACF7D8' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv' = 'B297AAF0672D66FE4AEB4AC2176B53B1CA5A0108A1AF4110F6035592FACC445C' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv' = '3D370943060DBF3F58789F3CBC9524277778F26839ED5C5DE5832E0B7EACF7D8' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv' = 'E6501A02F9C2806501BF28BFBF3AE3D30AB1952C06FD8C3873F0A7DDBFA81BE2' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv' = '3D370943060DBF3F58789F3CBC9524277778F26839ED5C5DE5832E0B7EACF7D8' + 'finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv' = '0FF36559E0D72CE2587000EE9606A83476539255C8143DE8FC9D78DAFA2CBE3F' + 'finding_list_msft_security_baseline_office_365_v1908_machine.csv' = '0DABC6A74D28BED4F82385F26F89360CB19012CD9EFE88837B396B9FADC287F0' + 'finding_list_msft_security_baseline_office_365_v1908_user.csv' = 'CFBF638CC774F32E0161ECCCFA2114C4834089BCED1E73AA6EA85C54372839AB' + 'finding_list_msft_security_baseline_windows_10_2004_machine.csv' = 'C7D05007325A860DB6324B57EA259FC35B03097147993F7A522C525865EA9515' + 'finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv' = '93E73671E818B6FC8AEB9BE9F277F566D4DEA7CAE435FA6008A36984B3ED9BAB' + 'finding_list_msft_security_baseline_windows_10_21h2_machine.csv' = 'D934D6C2EBE13908C559145FB153B8DBF153B77465431CDA864BDFB232DF9899' + 'finding_list_msft_security_baseline_windows_10_22h2_machine.csv' = '4532166EE8AC11D67DA8924AA5AA7E329D869E0171C923CD4D1F075095EEEA77' + 'finding_list_msft_security_baseline_windows_10_22h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_11_21h2_machine.csv' = 'CFA2D032064126E82E8AE6F072FFE1C29C88FC333B428D61E64A0587E6770235' + 'finding_list_msft_security_baseline_windows_11_22h2_machine.csv' = '88AEA6A8167A2A007B362922AAE4A6F97497002A8D74556A8661E415B6B85218' + 'finding_list_msft_security_baseline_windows_11_22h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_11_23h2_machine.csv' = '0FF1DBA22F3952B3D1671B714E96811D3743F1B92EE8BB6055F2ADF33F11F70B' + 'finding_list_msft_security_baseline_windows_11_23h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_11_24h2_machine.csv' = 'E9F11394BD87BC69C28E4361FC4ADE3155A9F4164B5AFE6B58DE774A0D3EB218' + 'finding_list_msft_security_baseline_windows_11_24h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_11_25h2_machine.csv' = '87C30F1463DB134E5E9E4C7F00B3082F943B7CB8EB7A40A1514BFD97CB4441DF' + 'finding_list_msft_security_baseline_windows_11_25h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_11_26h2_machine.csv' = 'E38B06CA46C73DF32812F4CF08A25B4F729DB7BB3E3B768CEDD9A4C0FAF12850' + 'finding_list_msft_security_baseline_windows_11_26h2_user.csv' = 'D9BF1D53FF063B4690A49D2C3E75D65818CB33158D419022FC5DDD4ECA4FC277' + 'finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv' = '2C6E4892FEB4C357BFE74568F8CBA8F671891DAF1A972FAC6F360894C0F0E326' + 'finding_list_msft_security_baseline_windows_server_2004_member_machine.csv' = '1043108D8C3D1103794D4B9448D53C3C65532DABEA850B5C978641A7294ED0AE' + 'finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv' = '3C1F8DB3897ABFC4EAC975A659F291DFDB691C0A335FE20F33C51FFB5DF10929' + 'finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv' = '40A8F4992877FBE045425CEB387AC69BBFA38472286B3B1194CBF93B1FCBB99E' + 'finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv' = 'CF0C0D259A4F961E4B8EB17906211AAE46DA1669652AC6F630F22FD3B3CBA8C3' + 'finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv' = 'FB3D9C464EFC4581A92E45498A4DC77C392572CAB676F786552AEA5517E62D1B' + 'finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv' = '430CECB0332DDEBE554651279EF9EF20238162EDC5AF475F9C3DE100A044A4B3' + 'finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv' = '26BA8263AA80EA418176B96E395B6A407FC9F5E59543B9310076B582262B7F96' + 'finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv' = '53BBB920F4A04367AD7725EF21B2F6C341DDD48A6DBA1870159391EBC0F75C4A' + 'finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv' = 'EDC1F6A580735A12D5054CCB1333CDFF966B1C2040E3140267E356B5CDC13A94' + 'finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv' = 'A632A3E38D867F3DD6D91214F3C73308F0904E8BF2AA9240F38051B5EDF32573' + 'finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv' = 'DA292964866AD8B0C8B82C676069C27BCC0C2A04C392A00E8484CF49565D63FA' + 'finding_list_translation.csv' = '00CA43CDC8EBAE362B114EC3BA801D87694026748175839492F38E14B1592863' + } +} diff --git a/vendor/lists/hardeningkitty_lists_manifest.psd1.p7s b/vendor/lists/hardeningkitty_lists_manifest.psd1.p7s new file mode 100644 index 0000000000000000000000000000000000000000..39fb2a5057da8e72875f50d177758965ef2cdf19 GIT binary patch literal 1974 zcma)+dpOgJAIJCoZnNCB7W4BfB@* zF?mT5K!6+;;tr98Ct!!HiRj(jn#wj+)FsBbj(Hz7X_&yz?wZTax;=en@8v1lW&20ZrLC6b z<<8=hG`^f~l@&`4IHgNelQ5moU+lUU?2HZ%{alm{!8&q@zh2XRL&BpZUw!Wo6^-@ zW{8H~&ZAfUoDpC8M8BCj^OVgOl%vxd1`CeLUJG(5kCQ0J9^Y5J&*$ZYf$fRB?EAYd z^fsI?a;tDYdt=S|AG}Gk%t4Y{pWUcT8G+O&MNVa~H>Du#G9T!+veC6xlS$}n{*kB8 z;2KeSJ_9nY@DX+YK{)OFg zj?;YMI$>>U({Z4@6nlBze4lv|TCc{o)-Qz}LM{ewG%9k3tjY1?AQXTAckGErh{!D# zF(?4ogu$R7;v!M`Th@aq5andH8Oi`~I06d&8(0hyrUp|nd*<{LG-cub#vC#5ynq`? zT?(uFp0q8*w@3pZ-cGHD8`)oPBI844OiI??7P9HOhZudx3jC8Qbz7vUmq22v7s`J$ z4-(a>^b88Ap^5<|`wMU028Li|jJ;u#Cy`&RqHk%gOQ?wLxBGA98CsZ{qv&bpW_Z$k zI6k73nwf8$2_r%?m1l(XRrx_8nlVd92F+lt?QAk{edvlzY07wea{uw*s-0h@+zoj9 znHrg6lNTUv;fLAvUSijRg1^?+G>_y~J`xr@DWor|y`-hZ^Z?m)t_{}@`5rS87t(klM)W|x=(2j#Lr=kxz5td! zf8~_BKs)w}8Zz$(2jL+#g?z$?;`bF0H*B?)slz3`YXMx`$11!;1K&aWl%CXdW+Xe( zCgXrV%{fc8JJ8QN&xjL8HUJ;U-AF60u(a@ano95;rFz3_~DAl)5{-hFa0h~h#FyzF6gt}g2S@Gz=NOcobi$Gs+B$$F?p02$v+6okLLnk zR3bW=_d*PrOPwudQ`r3lqV$cF{++@ipE4u6UkAgzJnbgy@|Ab{4#Q)fn?KjGc7M=V zw9@R`Qd67p=nQAFwK=L%A8*~(=DVOX{Yi#gWObP}A#&D!^dR<4nP>P}xRH1>!(Zw! zCre_1r?zb4x24c6iT!Ws{daMG@7?b_x}`H13xp)}x=bletho0lCVbY^%PG2-7~k;b zvoaZ?+;l1+VbQF--*wOIO`E8Ud`qep+3I^-m&Nh-|@xa z;85!NWSgehU|+@6Te4Pm%xFtApK_XwFypk^7|SjGTI}Phl$QBkH#{N}rV=BZb4*f5 zGaA;RhwpNEwG^T|b4R_(`lDwywld6CoT|uxm@a6dyplFNvi3kUaB9yU(%o(N(b2sWq}_s^ls zMx;Dn)sQwV$x;YUazQqtr=Hx9DDDJhN3W$4JjN;3rVRrAhbZPVH~N*9q-~_VYox3{ z&Sys3y0?#b|IV>o@nxH?MaV3d{Zz)9d4r$bc1$T=(OD|?Mm5}1O_)(gs%soxT2=_n zs>_&gbsW*q9Y>@xJazmnP^?*lX!@p&(YbD?YtNPa{3F{>G8s;EOouzk6uaFI_n zIjVzu5^}qsm$!Sm)P!oKtNtLaOIsl&*I{48#hMSFxO80HtWJG5=JVTWO-dK-Y)b_% zM8dgW@}~%g7dbMQqA(G@{zh}1^Y?1W$C~51UZA!1sFWs9dVYyAHsBVml7>7fE`H&a anm=HvO=;TsjksvqM%8Pn{clW5%0B@%=3hzx literal 0 HcmV?d00001 diff --git a/vendor/vendor-manifest.json b/vendor/vendor-manifest.json new file mode 100644 index 0000000..202db76 --- /dev/null +++ b/vendor/vendor-manifest.json @@ -0,0 +1,151 @@ +{ + "files": { + "HardeningKitty.psd1": "94378764787cd0c7125c5c3ce928803b46ee7d7d3fe21c2b27ddeb23c11377a7", + "HardeningKitty.psm1": "b799ec1b17de5ce63f7a8ea34af3beba1d24fcaddf7e3774f797096f5c43e2a0", + "LICENSE": "a879ba6ccdcd2ea55da97b999edd2c401c8589ca946f238236bf93aa40e74d56", + "lists/finding_list_0x6d69636b_machine.csv": "cc6cf409c7cb0f7dc0caeb82b8323dcc13ddb4dcb88e35e9e2cc4f52874816f4", + "lists/finding_list_0x6d69636b_user.csv": "c8cf8a5a7b46e4f94d7b57601732a2359651c878e93ad95b3cf8684d0887a2d5", + "lists/finding_list_4d5a_machine.csv": "d20d7dfbca7f7100fe5cb639a125aeafe163503e7b5856da0308175f1dd15663", + "lists/finding_list_bsi_sisyphus_windows_10_hd_machine.csv": "e1e554df8f04513ca288b526fbbad557ea58976197d31f13658e7ebe9bcbf146", + "lists/finding_list_bsi_sisyphus_windows_10_hd_user.csv": "063f7684d3bad43c6221f7193fca1efbd59a92e5a30b08818361f9d03a41ece6", + "lists/finding_list_bsi_sisyphus_windows_10_nd_machine.csv": "3117404f5081a907671b5b6a0f5f06cd5e161c131355f3df7220736051b0da5d", + "lists/finding_list_bsi_sisyphus_windows_10_nd_user.csv": "fab458bf91a38cbe5f57212c370c4154874884492389d2e92c8d238651cd9488", + "lists/finding_list_bsi_sisyphus_windows_10_ne_machine.csv": "705eff0788457402919ba967095259b922559c6d1ff17f94c866c45428cc9526", + "lists/finding_list_bsi_sisyphus_windows_10_ne_user.csv": "fab458bf91a38cbe5f57212c370c4154874884492389d2e92c8d238651cd9488", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1809_machine.csv": "bb5a8b9f0bad5d81e926071a93ce965beda1bb1c4cb7727c7823744da3071a8a", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1809_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1903_machine.csv": "4557143f380b475bcb3e5118b8f49c039c12ba2c144f7b48cf6202a861eedc63", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1903_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1909_machine.csv": "4557143f380b475bcb3e5118b8f49c039c12ba2c144f7b48cf6202a861eedc63", + "lists/finding_list_cis_microsoft_windows_10_enterprise_1909_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "lists/finding_list_cis_microsoft_windows_10_enterprise_2004_machine.csv": "94e42738f1083d618c9d762bd08c44465a03b68d2e5893d038abeaed2d2b821f", + "lists/finding_list_cis_microsoft_windows_10_enterprise_2004_user.csv": "b2c67d9ee3b08db0825a01844035825a6b16529395bb12e8b8ab4b65a4395fb8", + "lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_machine.csv": "ddabd3fafbe87af595613e051381fc3071f1488615f416deeaddb7c12e416ed2", + "lists/finding_list_cis_microsoft_windows_10_enterprise_20h2_user.csv": "4c77315f79e51214306c70591d02b742515b43484820fe14c61ddf7942b98a2b", + "lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_machine.csv": "d2fca2cc80c0139d10177b0568d8d9bccafc3ef4fa2d978d5809111b3b47cc0d", + "lists/finding_list_cis_microsoft_windows_10_enterprise_21h1_user.csv": "4c77315f79e51214306c70591d02b742515b43484820fe14c61ddf7942b98a2b", + "lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_machine.csv": "c4808aca88037aac3076863ca24099cd52e41c1a3f672947f33e3caf10f083b0", + "lists/finding_list_cis_microsoft_windows_10_enterprise_21h2_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_machine.csv": "5fc9546f9a2cd7894aee0d3c80f483ced5e032cc8800082a1d9f15b793bb02c1", + "lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_machine.csv": "d29c3fd8c788a5a59eccf8ed2e15e8e3756431f70aa787b352da80fe124b0d98", + "lists/finding_list_cis_microsoft_windows_10_enterprise_22h2_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_machine.csv": "c4808aca88037aac3076863ca24099cd52e41c1a3f672947f33e3caf10f083b0", + "lists/finding_list_cis_microsoft_windows_11_enterprise_21h2_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_machine.csv": "9b94df97ae465a6849b0a25f1e1da857422cf7a20584e296f2cef761c1ef66ca", + "lists/finding_list_cis_microsoft_windows_11_enterprise_22h2_user.csv": "af2df99e7a4b65f921b11b71623fba3e2b9f2e8eb21e0f34d24040e958734047", + "lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_machine.csv": "ed249bca62f1a6a71addfe4b2edf9a23e748e0c083f4ed7e99f35eb6562c6a81", + "lists/finding_list_cis_microsoft_windows_11_enterprise_23h2_user.csv": "7263da359d9aef3ffa6b7398cdf0ec87233bedd29d867a0a50dcc1e21df110d8", + "lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_machine.csv": "5b9e83822a3aa9526b2bfd2bf56d046accc743bf5a45a89332ebea9f93db1003", + "lists/finding_list_cis_microsoft_windows_11_enterprise_24h2_user.csv": "02779ea283ef5ddf18cfeb14a05fbb244604e7c042e96b1839dad6b92411a563", + "lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_machine.csv": "ab6757a924e54116ee1b22c11f1a0fdb5b0b053acc16096551198ce837a0f181", + "lists/finding_list_cis_microsoft_windows_11_enterprise_25h2_user.csv": "3c07acb7b8d32444c02a36b1af31a13e8757b7bc9522cfeb815e7a1b41d51520", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_machine.csv": "2778978b81286378f11834f6ab4384bdfca4023eb89767bfaea21427013b8b59", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_2.4.0_user.csv": "1e7a9302ac4361b1ec54ebb66aaf121257d39a6d44b6905ccb4cea5de93bd8fb", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_machine.csv": "1d23a4bc44936fe3b94faa50ffc5245dce9726b502cb6331497ffcd0998704cb", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_2.6.0_user.csv": "420893d86c78c76f07fc346c3224475ae84b873450274e75692e91e936e4a9b6", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_machine.csv": "8d891f2a16a930c604f4c1d606cded73a233f27b2ed518cb1bc4f553ecf241f8", + "lists/finding_list_cis_microsoft_windows_server_2012_r2_3.0.0_user.csv": "10221953c22731fbb5cc96c11cce27e36c96c07c6e55d899d7506dadd0e2f17c", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_machine.csv": "ce8aa8166ed28ece859a5fe8567c649831322057ab6b1de52aab7b54b15871fb", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_1.2.0_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_machine.csv": "7b9a195d4ff36bc7fbdb9bdf261180787e10812fd9516e0f11487e4c4431880b", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_1.3.0_user.csv": "612a035a6a6e6fd612f2c96d623318b458b446ea608a983dd7b8bee0934a1bd0", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_machine.csv": "e23d2e810fc9fbe09886f56e96e8789fd239c7400f681ca13ce829c691a28bc9", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_machine.csv": "a6c4f1e520c40cb3538b11b4c7a2a9524b3c704d989ffe899a25a8d35521a0c8", + "lists/finding_list_cis_microsoft_windows_server_2016_1607_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_machine.csv": "d45a797dfdd6e57b2d4d89f3ebf7968c3394b015108ade945e1b38714ced9c04", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_1.1.0_user.csv": "a0749eabe753a7e85b6da5ae0e816eacb388596abf8f637a1e0c5b8e138ce16b", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_machine.csv": "5a118146523c2d0b8c444af901554f179e46954865c4c5b115f4b16d2996cb1f", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_1.2.1_user.csv": "612a035a6a6e6fd612f2c96d623318b458b446ea608a983dd7b8bee0934a1bd0", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_machine.csv": "27004ca663cb422c915610f833c23b79d8f8f4ae1ef33f960c53804d125fd2bf", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_machine.csv": "bf8e4f821dcef989af9a0189ed9c91e6903b3a80f6f4d0340a8d84e05e36013f", + "lists/finding_list_cis_microsoft_windows_server_2019_1809_3.0.0_user.csv": "d3d8e3df310719fb3f006a933fecda4f35a6ec4c22eacd6eecf29986ed232254", + "lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_machine.csv": "8c00cac3a709782ee1ced106df9d896a6af3df1adc27745e39d6668a648594f4", + "lists/finding_list_cis_microsoft_windows_server_2022_21h2_1.0.0_user.csv": "cec62f77eb39ae43fbe8b19ad5ee8242cf53b514735adc6b41eedd15fd3bafee", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_machine.csv": "1e1687757aa2339be955f0d12ca8f2c2514ede560ebf143d40ff97b3836d8cd4", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_2.0.0_user.csv": "98de51338225e35821e2ec63caddf9e8493662a507c818588ab37d7fb8f5a302", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_machine.csv": "bd1c6f58970885272175afe678c1dc95a9391e6ddf6b408a106199410143029e", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_3.0.0_user.csv": "99bc6878f443f1b81a64171068ef3534afe32d636a7c4beab9a6726ead826681", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_machine.csv": "45dc9010fd9bad2b28e2645c07476d838758d2554d5618be8fd906a588ea844c", + "lists/finding_list_cis_microsoft_windows_server_2022_22h2_4.0.0_user.csv": "220fbfcfbbcd1ab1910dc689a1a4300dc1c4c2d3ed442b9f8f54cbe6b39e012d", + "lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_machine.csv": "0c272b427b01a5ecbeb95cbe764e3ad20d1dfcb3e299ce2dd9d72468bc7c368b", + "lists/finding_list_cis_microsoft_windows_server_2025_24h2_1.0.0_user.csv": "0a2c8354f8c4578f0925a598b1bc855a29fb54458b2465f7e174ab064df9402b", + "lists/finding_list_dod_microsoft_windows_10_stig_v2r1_machine.csv": "59a106a408cc7db4a46db87f119ec001b28e27816d5c93cce40af68892eac122", + "lists/finding_list_dod_microsoft_windows_10_stig_v2r1_user.csv": "c8433c698d6f6e08c67d5a36657f23d21369595084daff15a4bb2bc9f75cca07", + "lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_machine.csv": "6258ccfdebdf18d68a300683cf8b68a57a1c6c98fac5e796e2f7200f1ac020cf", + "lists/finding_list_dod_microsoft_windows_server_2019_dc_stig_v2r1_user.csv": "aa3b8f180bfeedcc690f427fd0756292019f9d991d4f6b06e09371c718a0af07", + "lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_machine.csv": "6b2dd93bac5391ec14ab1bac2bbd82f01bc2af5db8f3139359469c4591d852a3", + "lists/finding_list_dod_microsoft_windows_server_2019_member_stig_v2r1_user.csv": "aa3b8f180bfeedcc690f427fd0756292019f9d991d4f6b06e09371c718a0af07", + "lists/finding_list_dod_windows_defender_antivirus_stig_v2r1.csv": "00fdfbefc9ac9d00a984d06e2b4c28ddb600852441d82f6f3c875f3c39e5d1b7", + "lists/finding_list_dod_windows_firewall_stig_v1r7.csv": "82438b3773d7de069cc1e8bf2831df2e678f5d1bde96b31145acb420f213a9da", + "lists/finding_list_intune.csv": "301cde82e178abdabc4a4f070b8513964a5abb06deac2d719373a6ec41d2707d", + "lists/finding_list_microsoft_windows_tls.csv": "e2a4fc5ea430764131fc1f2f7bef370bc77c140fc9540e87a630814b55a76d15", + "lists/finding_list_microsoft_windows_tls_future.csv": "f777f353ae37d1be4de6529b2eb53f45e89ce7283eda2bd020ced4cc65e6c68e", + "lists/finding_list_msft_security_baseline_edge_107_machine.csv": "2ffba25ae476fd3890038e05e48ad85242442ee826af658071157266bae204bb", + "lists/finding_list_msft_security_baseline_edge_112_machine.csv": "933fc26792625c7ad345c54fc42607a008cc9b199b7dd5f915a42295ab399251", + "lists/finding_list_msft_security_baseline_edge_114_machine.csv": "956f68d455dd40eb9aae625df61d6512471e4c99d22a7e39b37708c2c3bb0c87", + "lists/finding_list_msft_security_baseline_edge_117_machine.csv": "1dc3be1f589082b1e212b08a05f20de2897f8bfd92914bd1a6ca7d5b53447bac", + "lists/finding_list_msft_security_baseline_edge_128_machine.csv": "a5580c2c1f970c46ff6ca92ec64e81fa49cd301f98c12c2b3053132de06f0b2e", + "lists/finding_list_msft_security_baseline_edge_139_machine.csv": "4f6354db6f1fe005359ea5e6ea3f6d871664caa538f8f9bb5da9403bc9db3e2a", + "lists/finding_list_msft_security_baseline_edge_151_machine.csv": "a4c624dfcb1a8c3702ae00e84bc51496b661a51178577de1f1b6f02cdf10a782", + "lists/finding_list_msft_security_baseline_edge_87_machine.csv": "ad47b85960a61eed3ea25496fe473fae2bd241bcf25a7da0ea6caababa2c2279", + "lists/finding_list_msft_security_baseline_edge_88_machine.csv": "9b2df280eea330efe6ab6c6c9ccf60a75f47d489a4e1fafdefaa5215de7cbf4b", + "lists/finding_list_msft_security_baseline_edge_92_machine.csv": "462e950f688bcc23ad46c0fb39ca138b616a7cf4a3f024213c4f86ece39d235f", + "lists/finding_list_msft_security_baseline_edge_93_machine.csv": "8bb5b5c0812724a870abb7e51d0fe27956781348dab480b4bc4521ea474c2b6b", + "lists/finding_list_msft_security_baseline_edge_95_machine.csv": "7d9e83a13e6d348a9f02ae985d3299462ec5a83c10b7d0fcc8f13fdbbbfc43ff", + "lists/finding_list_msft_security_baseline_edge_96_machine.csv": "9ec876d2841daf216dacac4001ddfb820efbf69a69835b4d197531ed67ff601f", + "lists/finding_list_msft_security_baseline_edge_97_machine.csv": "b2a0a3a5175e8d09586d1bbcfda986e43cd4fe999d8af44b8b5e1513ce393cef", + "lists/finding_list_msft_security_baseline_edge_98_machine.csv": "95088ae545a08536a9165d463a9248c4af2fffb68ca8b0006d97f039ba5da782", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_machine.csv": "bc1e668906f6655c01227ec439e85af7f5327352e6a4eafe5647374d5f35aafe", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2104_user.csv": "6e6d998a0a9e790a0c645c6ac43eb1516bf9ffb4e7ec06d884d14d3014b475eb", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2112_user.csv": "8ad1c68511b809fb71d5d23de62a90fe81254f4d72f261a16112083cf98d46eb", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2206_user.csv": "c991fcfc1bd3cece4e7a2b89eec450bffcf75db1b199e4faf07ac0fd64e80d47", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2306_user.csv": "b297aaf0672d66fe4aeb4ac2176b53b1ca5a0108a1af4110f6035592facc445c", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2412_user.csv": "e6501a02f9c2806501bf28bfbf3ae3d30ab1952c06fd8c3873f0a7ddbfa81be2", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_machine.csv": "3d370943060dbf3f58789f3cbc9524277778f26839ed5c5de5832e0b7eacf7d8", + "lists/finding_list_msft_security_baseline_microsoft_365_apps_v2512_user.csv": "0ff36559e0d72ce2587000ee9606a83476539255c8143de8fc9d78dafa2cbe3f", + "lists/finding_list_msft_security_baseline_office_365_v1908_machine.csv": "0dabc6a74d28bed4f82385f26f89360cb19012cd9efe88837b396b9fadc287f0", + "lists/finding_list_msft_security_baseline_office_365_v1908_user.csv": "cfbf638cc774f32e0161ecccfa2114c4834089bced1e73aa6ea85c54372839ab", + "lists/finding_list_msft_security_baseline_windows_10_2004_machine.csv": "c7d05007325a860db6324b57ea259fc35b03097147993f7a522c525865ea9515", + "lists/finding_list_msft_security_baseline_windows_10_20h2_21h1_machine.csv": "93e73671e818b6fc8aeb9be9f277f566d4dea7cae435fa6008a36984b3ed9bab", + "lists/finding_list_msft_security_baseline_windows_10_21h2_machine.csv": "d934d6c2ebe13908c559145fb153b8dbf153b77465431cda864bdfb232df9899", + "lists/finding_list_msft_security_baseline_windows_10_22h2_machine.csv": "4532166ee8ac11d67da8924aa5aa7e329d869e0171c923cd4d1f075095eeea77", + "lists/finding_list_msft_security_baseline_windows_10_22h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_11_21h2_machine.csv": "cfa2d032064126e82e8ae6f072ffe1c29c88fc333b428d61e64a0587e6770235", + "lists/finding_list_msft_security_baseline_windows_11_22h2_machine.csv": "88aea6a8167a2a007b362922aae4a6f97497002a8d74556a8661e415b6b85218", + "lists/finding_list_msft_security_baseline_windows_11_22h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_11_23h2_machine.csv": "0ff1dba22f3952b3d1671b714e96811d3743f1b92ee8bb6055f2adf33f11f70b", + "lists/finding_list_msft_security_baseline_windows_11_23h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_11_24h2_machine.csv": "e9f11394bd87bc69c28e4361fc4ade3155a9f4164b5afe6b58de774a0d3eb218", + "lists/finding_list_msft_security_baseline_windows_11_24h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_11_25h2_machine.csv": "87c30f1463db134e5e9e4c7f00b3082f943b7cb8eb7a40a1514bfd97cb4441df", + "lists/finding_list_msft_security_baseline_windows_11_25h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_11_26h2_machine.csv": "e38b06ca46c73df32812f4cf08a25b4f729db7bb3e3b768cedd9a4c0faf12850", + "lists/finding_list_msft_security_baseline_windows_11_26h2_user.csv": "d9bf1d53ff063b4690a49d2c3e75d65818cb33158d419022fc5ddd4eca4fc277", + "lists/finding_list_msft_security_baseline_windows_server_2004_dc_machine.csv": "2c6e4892feb4c357bfe74568f8cba8f671891daf1a972fac6f360894c0f0e326", + "lists/finding_list_msft_security_baseline_windows_server_2004_member_machine.csv": "1043108d8c3d1103794d4b9448d53c3c65532dabea850b5c978641a7294ed0ae", + "lists/finding_list_msft_security_baseline_windows_server_2022_21h2_dc_machine.csv": "3c1f8db3897abfc4eac975a659f291dfdb691c0a335fe20f33c51ffb5df10929", + "lists/finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv": "40a8f4992877fbe045425ceb387ac69bbfa38472286b3b1194cbf93b1fcbb99e", + "lists/finding_list_msft_security_baseline_windows_server_2025_24h2_dc_machine.csv": "cf0c0d259a4f961e4b8eb17906211aae46da1669652ac6f630f22fd3b3cba8c3", + "lists/finding_list_msft_security_baseline_windows_server_2025_24h2_member_machine.csv": "fb3d9c464efc4581a92e45498a4dc77c392572cab676f786552aea5517e62d1b", + "lists/finding_list_msft_security_baseline_windows_server_2025_2506_dc_machine.csv": "430cecb0332ddebe554651279ef9ef20238162edc5af475f9c3de100a044a4b3", + "lists/finding_list_msft_security_baseline_windows_server_2025_2506_member_machine.csv": "26ba8263aa80ea418176b96e395b6a407fc9f5e59543b9310076b582262b7f96", + "lists/finding_list_msft_security_baseline_windows_server_2025_2602_dc_machine.csv": "53bbb920f4a04367ad7725ef21b2f6c341ddd48a6dba1870159391ebc0f75c4a", + "lists/finding_list_msft_security_baseline_windows_server_2025_2602_member_machine.csv": "edc1f6a580735a12d5054ccb1333cdff966b1c2040e3140267e356b5cdc13a94", + "lists/finding_list_msft_security_baseline_windows_server_20h2_dc_machine.csv": "a632a3e38d867f3dd6d91214f3c73308f0904e8bf2aa9240f38051b5edf32573", + "lists/finding_list_msft_security_baseline_windows_server_20h2_member_machine.csv": "da292964866ad8b0c8b82c676069c27bcc0c2a04c392a00e8484cf49565d63fa", + "lists/finding_list_translation.csv": "00ca43cdc8ebae362b114ec3ba801d87694026748175839492f38e14b1592863", + "lists/hardeningkitty_lists_manifest.psd1": "fc2ad9d813ace832d5fc64fef90124123a00497a82bc611d58fa1d0bc3272d71", + "lists/hardeningkitty_lists_manifest.psd1.p7s": "1508d9eb0f05a778697079f0a821ec34598bd3c02f1c3754213e7cb55f075b38" + }, + "source": "pinned GitHub archive (not a floating branch)", + "source_archive_sha256": "6d0f41a240c0b6713e56bae25c96563b0cae996b66c088ead593846d02164170", + "upstream_commit": "acf9ecee3d044a9337df7aad80e730cbd746e8de", + "upstream_repository": "0x6d69636b/windows_hardening" +}